Configuring Spectrum Tomcat cipher order for ssl

Products

• Spectrum

Issue/Introduction

According to Oracle documentation, you can configure the tomcat server to utilize the ciphers on the Tomcat server instead of using the client ciphers:

https://tomcat.apache.org/tomcat-9.0-doc/config/http.html 
 

honorCipherOrder

Set to true to enforce the server's cipher order (from the ciphers setting) instead of allowing the client to choose the cipher. The default is false.

 

Environment

Release: Any
Component: SPCOCK

Resolution

The honorCipherOrder does not work.  Instead, you need to use the Alias:
 

useServerCipherSuitesOrder

This is an alias for the honorCipherOrder attribute of the default SSLHostConfig element.

In the $SPECROOT/tomcat/conf/server.xml file, add the following to the SSL connector statement:

useServerCipherSuitesOrder="true"

Cycle the Spectrum Tomcat process.

ex.

     <Connector
           port="8443"
           enableLookups="true" disableUploadTimeout="true" tcpNoDelay="true"
           acceptCount="100" scheme="https" secure="true" SSLEnabled="true"
           clientAuth="false" sslProtocol="TLS"
           sslEnabledProtocols="TLSv1.2"
           useServerCipherSuitesOrder="true"
           ciphers="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
                    TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,
                    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
                    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
                    TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256,
                    TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,
                    TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
                    TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
                    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
                    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
                    TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,
                    TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
                    TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
                    TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
                    TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
                    TLS_DHE_RSA_WITH_AES_256_CBC_SHA,
                    TLS_DHE_RSA_WITH_AES_128_CBC_SHA256,
                    TLS_DHE_RSA_WITH_AES_256_CBC_SHA256"
           keystoreFile="C:/Spectrum/custom/keystore/cacerts"
           keystorePass="changeit">
     </Connector>