JTS SSL: Valid ciphers for server certificate? [SOLVED]
Sorry for the long introduction but I'm not an SSL expert, so I basically have to describe what I did:
I removed the "ciphers" line from the Tomcat connector which allowed me to successfully establish a connection to the server with firefox and start the JTS setup. However at the last step of the setup (when choosing the public URL), the setup program seems to trigger an internal connection to the server (server-to-server) which then again failed with an SSL error.
To verify that this is not a general SSL setup error, I created a new CA and server certificate using OpenSSL and a lower cipher suite. This time I was able to complete the setup step which tests the connection to the server. So I'm pretty sure that the only reason I can not complete the setup with my GnuTLS certificate is an incompatibility with the preconfigured cipher suites.
Obviously the "ciphers" parameter in the Tomcat server.xml was configured for a reason as some component of RTC does not seem to be able to deal with higher cipher suites.
So my question:
Is there a way to change this and allow cipher suites compatible with GnuTLS?
As I use GnuTLS for all my SSL needs, I would very much like to use my existing CA to create a server certificate for RTC. However I'm not sure which cipher suite I have to use or if it's possible at all (maybe my CA already uses a cipher suite which is too high for RTC). I never had problems before and the certificates created with my setup work fine for Apache HTTPD.
I'm not sure how to determine the correct ciphers as those names from the server.xml don't tell me much.
Did anyone ever successfully create a JTS server certificate using gnutls? Which parameters did you use?
One answer
After analyzing the problem with wireshark and much trial & error, I finally figured it out. It seems that JTS can not deal with certificates which are using more than 2048 bits. While the server can handle those certificates and allows browser to connect, the server's internal connections to the webservices however will fail.
Using certificates with more than 2048 bits limits the number of algorithms which can be used and therefore the internal connections, which can only use lower grade ciphers, will get an ssl handshake error leading to a javax.net.ssl.SSLPeerUnverifiedException ("peer not authenticated") error.