Disabling SSLv3 and SSLv2 in Tomcat and JBoss Web

Resolution

Red Hat recommends disabling SSL and using only TLSv1.1 or TLSv1.2. Backwards compatibility can be achieved using TLSv1.0. Many products Red Hat supports have the ability to use SSLv2 or SSLv3 protocols, however it is strongly recommended against.

JBoss Web in EAP 4/5 and JBoss 4.x/5.x products

Note: the following mitigation instructions are only applicable if you are using the JSSE connectors for HTTPS configuration. Refer to the Tomcat APR section if you are using native connectors.

For EAP 4/5 and JBoss 4/5.x products based on EAP 4/5, SSLv2 and SSLv3 can be disabled by configuring the https connectors to have the sslProtocols attribute set to "TLSv1,TLSv1.1,TLSv1.2" in the configuration located within $JBOSS_HOME/jboss-as/server/$JBOSS_PROFILE/deploy
/jbossweb.sar/server.xml. For example:

      <Connector protocol="HTTP/1.1" SSLEnabled="true" 
           port="8443" address="${jboss.bind.address}"
           scheme="https" secure="true" clientAuth="false" 
           keystoreFile="${jboss.server.home.dir}/conf/keystore.jks"
           keystorePass="rmi+ssl"
           sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" />

The sslProtocols attribute specifies the versions of the SSL protocol to use. If not specified, the default is "TLS". Note TLSv1.2 is only available when using JDK 7 and higher. For more information see http://docs.jboss.org/jbossweb/2.1.x/config/http.html. Note that this applies to only JBoss Web prior to 7.x. In 7.x and later, a connector supports the protocol attribute as discussed for EAP 6 below. Refer to http://docs.jboss.org/jbossweb/7.0.x/config/ssl.html for more information in regards to this.

JBoss Web in EAP 6 and JBoss 6.x products

Note: the following mitigation instructions are only applicable if you are using the JSSE connectors for HTTPS configuration. Refer to the Tomcat APR section if you are using native connectors.

For EAP 6 and JBoss 6.x products based on EAP 6, SSLv2 and SSLv3 can be disabled by setting the protocol attribute to "TLSv1,TLSv1.1,TLSv1.2" for the HTTPS connector in the web subsystem. This can be done using the following CLI commands.
In standalone mode:

/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=protocol,value="TLSv1,TLSv1.1,TLSv1.2")
:reload

In domain mode

/profile=default/subsystem=web/connector=HTTPS/ssl=configuration/:write-attribute(name=protocol,value="TLSv1,TLSv1.1,TLSv1.2")
:reload

Alternatively, edit the configuration file manually:

In standalone mode: $JBOSS_HOME/standalone/configuration/$JBOSS_PROFILE.xml
In domain mode: $JBOSS_HOME/domain/configuration/$JBOSS_PROFILE.xml

Locate and edit the following element in the configuration file. The protocol attribute is set to "TLSv1,TLSv1.1,TLSv1.2" in this example.

            <connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" enable-lookups="false" secure="true">
                <ssl name="https" key-alias="KEY_ALIAS" password="SECRET" certificate-key-file="${jboss.server.config.dir}/keystore.jks" protocol="TLSv1,TLSv1.1,TLSv1.2"/>
            </connector>

The protocol attribute specifies the version of the SSL protocol to use. Supported values include SSLv2, SSLv3, TLSv1, SSLv2+SSLv3, and ALL. The default is ALL. See the EAP 6 Administration and Configuration Guide for more information.

EAP 6 Management Interfaces

EAP 6 users exposing HTTPS Management Interfaces may not be able to disable SSLv3 via the current configuration options exposed by security-realm/server-identities/ssl configuration parameter. A bug has been filed to add functionality that would make this possible. The following steps allow you to mitigate this issue on EAP 6 systems exposing HTTPS Management Interfaces.

• Explicitly set the protocol attribute in the ssl configuration to TLSv1:

                <server-identities>
                    <ssl protocol="TLSv1">
                        <keystore path="https.keystore" relative-to="keystore.home" keystore-password="secret" alias="https" key-password="secret" />
                    </ssl>

• Use firewall rules to prevent access to the management https port (default is 9443) from external locations, for example from outside the corporate firewall.
• If HTTPS management access on port 9443 is required from outside the firewall, stunnel can be used to achieve this. Refer to Resolution for POODLE SSLv3.0 vulnerability (CVE-2014-3566) for components that do not allow SSLv3 to be disabled via configuration settings for more details.

Tomcat

When using Tomcat with the JSSE connectors, the SSL protocol to be used can be configured via $TOMCAT_HOME/conf/server.xml. The following example shows how the sslProtocol in an https connector is configured.

Tomcat 5 and 6 (prior to 6.0.38)

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslProtocols = "TLSv1,TLSv1.1,TLSv1.2" />

Tomcat 6 (6.0.38 and later) and 7

    <Connector port="8443" protocol="org.apache.coyote.http11.Http11Protocol"
               maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
               clientAuth="false" sslEnabledProtocols = "TLSv1,TLSv1.1,TLSv1.2" />

If the sslEnabledProtocols or sslProtocols attributes are specified, only protocols that are listed and supported by the SSL implementation will be enabled. If not specified, the JVM default is used. The permitted values may be obtained from the JVM documentation for the allowed values for algorithm when creating an SSLContext instance e.g. Oracle Java 6 and Oracle Java 7.

Tomcat APR

When using Tomcat with the APR/Native connectors, the SSL protocol to be used can be configured in $TOMCAT_HOME/conf/server.xml. The following example shows how the SSLProtocol in an https connector is configured.

<Connector port="443" maxHttpHeaderSize="8192"
               maxThreads="150"
               enableLookups="false" disableUploadTimeout="true"
               acceptCount="100" scheme="https" secure="true"
               SSLEnabled="true" 
               SSLProtocol="TLSv1"
               SSLCertificateFile="${catalina.base}/conf/localhost.crt"
               SSLCertificateKeyFile="${catalina.base}/conf/localhost.key" />

Configuration parameters are documented here. The default is for the SSLProtocol attribute to be set to ALL, with other acceptable values being SSLv2, SSLv3, TLSv1 and SSLv2+SSLv3. Starting with version 1.1.21 of the Tomcat native library any combination of the three protocols concatenated with a plus sign will be supported. Note that the protocol SSLv2 is inherently unsafe.