{"id":432,"date":"2014-05-05T19:33:26","date_gmt":"2014-05-05T18:33:26","guid":{"rendered":"http:\/\/www.simweb.ch\/blog\/?p=432"},"modified":"2014-05-05T19:33:26","modified_gmt":"2014-05-05T18:33:26","slug":"java-webstart-and-tls-1-0-oh-why","status":"publish","type":"post","link":"https:\/\/www.simweb.ch\/blog\/2014\/05\/java-webstart-and-tls-1-0-oh-why\/","title":{"rendered":"Java WebStart and >= TLS 1.0 &#8211; oh why&#8230;"},"content":{"rendered":"<p>An awful lot of security issues has lead Oracle to tighten things when it comes to Java WebStart as it is used in an awful lot of KVM over IP solutions. Some of those systems are even very picky on the Java version used. *blimey*<\/p>\n<p>Now I had those shiny new IBM SystemX x3650 m4 and a x3550 m4 that I was exploring when I was documenting settings for their remote service processor. In IBM (soon Lenovo?) SystemX M4 series this thing is called IMM2 (Integrated Management Module 2) and once you have installed it with a (not so cheap) license key you get a shiny remote KVM ability.<\/p>\n<p>I was unfortunate to look at the documentation and to discover the CLI parameter 'tls':<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">system&gt; help tls\r\n\r\n  usage:\r\n   tls [-options] - configures the minimum TLS level\r\n   -min &lt;1.0 | 1.1 | 1.2&gt; - Selects the minimum TLS level\r\n   -h - Lists usage and options\r\n\r\nsystem&gt; tls\r\n-min 1.0<\/pre>\n<p>So I though: \"TLS 1.0 is aging let's at least bump it to 1.1\". - Until that moment the remote management capability worked pretty well beyond some random Java quircks. But unfortunately I tried out a couple of settings so at first it wasn't obvious that it was due to this that Java stopped loading the Avocent KVM over IP applets and instead got greeted by this:<\/p>\n<pre class=\"brush: bash; gutter: true; first-line: 1\">javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake\r\n\tat sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)\r\n\tat sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)\r\n\tat sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)\r\n\tat sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)\r\n\tat sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)\r\n\tat sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)\r\n\tat sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)\r\n\tat sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)\r\n\tat com.sun.deploy.net.HttpUtils.followRedirects(Unknown Source)\r\n\tat com.sun.deploy.net.BasicHttpRequest.doRequest(Unknown Source)\r\n\tat com.sun.deploy.net.BasicHttpRequest.doGetRequestEX(Unknown Source)\r\n\tat com.sun.deploy.cache.ResourceProviderImpl.checkUpdateAvailable(Unknown Source)\r\n\tat com.sun.deploy.cache.ResourceProviderImpl.isUpdateAvailable(Unknown Source)\r\n\tat com.sun.deploy.cache.ResourceProviderImpl.getResource(Unknown Source)\r\n\tat com.sun.deploy.cache.ResourceProviderImpl.getResource(Unknown Source)\r\n\tat com.sun.javaws.LaunchDownload$DownloadTask.call(Unknown Source)\r\n\tat java.util.concurrent.FutureTask.run(Unknown Source)\r\n\tat java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)\r\n\tat java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)\r\n\tat java.lang.Thread.run(Unknown Source)\r\nCaused by: java.io.EOFException: SSL peer shut down incorrectly\r\n\tat sun.security.ssl.InputRecord.read(Unknown Source)\r\n\t... 20 more<\/pre>\n<p>OK, why did that happen - I though TLS 1.1 was supported by Java 7 for som time now- right?<\/p>\n<ul>\n<li>Java 6 did only support upt to TLS 1.0<\/li>\n<li>Java 7 (at least up to Update 55) did add support TLS 1.1 and TLS 1.2 but actually never enabled it by default<br \/>\nIf you want to enable it, open the Java Control Panel (javacpl) and enabled the newer TLS versions<\/li>\n<li>Java 8 seemingly <a href=\"https:\/\/bugs.openjdk.java.net\/browse\/JDK-7093640\">comes with TLS 1.1\/1.2 enabled by default<\/a><\/li>\n<\/ul>\n<p>If I had properly read the error message (*dou*) I would have far more quickly realized where to look for.<\/p>\n<p>Curently you have to either set IMM2's TLS version minimum to 1.0 (default) or fix your Java to allow newer TLS version.<\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>An awful lot of security issues has lead Oracle to tighten things when it comes to Java WebStart as it is used in an awful lot of KVM over IP solutions. Some of those systems are even very picky on the Java version used. *blimey* Now I had those shiny new IBM SystemX x3650 m4 &#8230; <a class=\"moretag\" href=\"https:\/\/www.simweb.ch\/blog\/2014\/05\/java-webstart-and-tls-1-0-oh-why\/\">more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_crdt_document":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-432","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/posts\/432","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/comments?post=432"}],"version-history":[{"count":0,"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/posts\/432\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/media?parent=432"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/categories?post=432"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.simweb.ch\/blog\/wp-json\/wp\/v2\/tags?post=432"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}