How to upgrade TLS 1.0 to TLS 1.2 on wso2product

Question

We are trying to upgrade TLS 1.0 to TLS 1.2 version in the WSO2 BPS.Following procedure for upgrading TLS latest version using this link Reference Link From WSO2 and our JAVA application is running in JDK 1.8.

Open the <PRODUCT_HOME>/repository/conf/tomcat/catalina-server.xml file.
Removed the sslProtocol="TLS" attribute and replaced it with sslEnabledProtocols="TLSv1.2" as shown below.

> <Connector SSLEnabled="true"  port="9443"
> protocol="org.apache.coyote.http11.Http11NioProtocol" scheme="https"
> secure="true" server="WSO2 Carbon Server"
> sslEnabledProtocols="TLSv1.2"
> svns:secretAlias="Server.Service.Connector.keystorePass"/>

Start the server.
To verify that the configurations are all set correct or not we execute the following command, java -jar TestSSLServer.jar localhost 9443 and getting TLS configuration response as TLSv1.2 only,

Supported versions: TLSv1.2
Deflate compression: no
Supported cipher suites (ORDER IS NOT SIGNIFICANT):
  TLSv1.2
     DHE_RSA_WITH_AES_128_CBC_SHA
     DHE_RSA_WITH_AES_256_CBC_SHA
     DHE_RSA_WITH_AES_128_CBC_SHA256
     DHE_RSA_WITH_AES_256_CBC_SHA256
     TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
     TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
     TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
     TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
----------------------
Server certificate(s):
  501fc1432d87155dc431382aeb843ed558ad61b1: CN=localhost, O=WSO2, L=Mountain View, ST=CA, C=US
----------------------
Minimal encryption strength:     strong encryption (96-bit or more)
Achievable encryption strength:  strong encryption (96-bit or more)
BEAST status: protected
CRIME status: protected

But when we captured the pcap file and in Wireshark it is showing like TLSv1.0 still as shown below:

Updated:

We have changed jre/lib/security/java.security as per @user7294900 instruction. when we set configuration in that java.security file, we are facing this error message in wso2BPMN. But we can able to view TLS version 1.2 in Wireshark capture with a handshake failure notification.

Wso2BPMN,

Caused by: org.apache.commons.mail.EmailException: Sending the email to the following server failed : smtp.office365.com:587
at org.apache.commons.mail.Email.sendMimeMessage(Email.java:1398)
at org.apache.commons.mail.Email.send(Email.java:1423)
at org.activiti.engine.impl.bpmn.behavior.MailActivityBehavior.execute(MailActivityBehavior.java:102)
... 192 more
Caused by: javax.mail.MessagingException: Can't send command to SMTP host;
  nested exception is:
javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
at com.sun.mail.smtp.SMTPTransport.sendCommand(SMTPTransport.java:1420)
at com.sun.mail.smtp.SMTPTransport.sendCommand(SMTPTransport.java:1408)
at com.sun.mail.smtp.SMTPTransport.ehlo(SMTPTransport.java:847)
at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:384)
at javax.mail.Service.connect(Service.java:297)
at javax.mail.Service.connect(Service.java:156)
at javax.mail.Service.connect(Service.java:105)
at javax.mail.Transport.send0(Transport.java:168)
at javax.mail.Transport.send(Transport.java:98)
at org.apache.commons.mail.Email.sendMimeMessage(Email.java:1388)
... 194 more

So, is there any configuration required for TLSv1.2 version upgrade.

Is this Change Cipher Spec message sent from the client or the server? Both should be sending one and this might just be the client indicating that it'd able to speak TLS 1.0 (just guesstimating based on a quick read of the TLS 1.2 RFC, so I might be off). — Joachim Sauer
@JoachimSauer Is this Change Cipher Spec message sent from the client or the server? It is client-side. we need some clarification about this. — VIVEK-MDU

user7294900 user7294900 · Accepted Answer · 2019-09-05T08:26:38

You need to disable TLS below 1.2

set the
 jdk.tls.disabledAlgorithms= SSLv2Hello, SSLv3, TLSv1, TLSv1.1
in the file jre/lib/security/java.security on the server.

Also try to reduce your ciphers as @Dimtri suggested

set ciphers that are supported only by TLSv1.2

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256

How to upgrade TLS 1.0 to TLS 1.2 on wso2product

Updated:

2 Answers