Cypher error for JTS setup URL
JTS is required to use port 10443 which is currently in Windows server. I am required to use SSL certificate signed by CA Entrust. Linux admin had created certification request and sent to Entrust. He received signed certificate files with .crt extension. I received 3 .crt files, installed the files using keytool and created keystore file ibm-team-ssl.keystore.
I changed port to 10443 in Tomcat/conf/server.xml. When trying JTS set up URL connection I get error:
An error occurred during a connection to <JTS setup URL>. Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap)
I tried using IE and Chrome and cannot connect. Error in Chrome: ERR_SSL_VERSION_OR_CIPHER_MISMATCH
On the server I checked using netstat -an command and the server is listening on port 10443. Is this issue with Certificate request or with the certificates issued by the CA Entrust ? Any help will be greatly appreciated.
Thanks
NP
One answer
If the server.xml file looks OK, you can use openssl to test the SSL connection as it gives more details than browsers do. You should have openssl installed by default on your Redhat Linux server.
openssl s_client -connect localhost:10443
Comments
Hi Donald
I compared /tomcat/conf/server.xml for block beginning with -->
<Connector port="10443"
and could not find any difference. Please see below results of the command you gave to test SSL connection. Kindly let me know what could be the problem.
]# openssl s_client -connect localhost:10443
CONNECTED(00000003)
139623445563208:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:744:
no peer certificate available
No client certificate CA names sent
SSL handshake has read 7 bytes and written 249 bytes
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
Thank You
NP
Can you see the "no peer certificate available" message? It means that the server does not provide any certificates so no clients can connect. I suspect that when you import the certificates into the keystore, it was not successful.