SSL with Tomcat/APR/OpenSSL

A heads up -- the documentation page on the configuration parameters for SSL has a number of errors - or at least "not best practice" points. My experience is with tomcat/APR/OpenSSL/Ubuntu 16.4/GoDaddy only - so that is what these comments relate to.

First - and MOST important - When you set up an SSL web server, you should ALWAYS test it to analyze the level of protection and exposure you have. Implementing SSL is a minefield, and has a terrible habit of making site admins feel "safe" just because they have turned the feature on. However there are a gazillion ways of configuring it, and the default options are (in the most part) weak.

So check -- are you "Heartbleed-safe", "Logjam-safe", etc, etc.

A very useful on line test tool is https://www.ssllabs.com/ssltest/. Sadly, this gives the documented bonita SSL configuration (at http://documentation.bonitasoft.com/?page=ssl#toc2) an "F" (very poor) rating. But with some tweaking it's possible to get up to an "A", but there maybe a number of OS dependencies that you need to untangle in order to resolve the "Logjam" attack in particular (see: https://weakdh.org/). For my own part, I had to rebuild the libtcnative library from source to finish the job.

Also; the Bonita-suggested "SSLVerifyClient=optional" setting causes problems for a number of Android and Apple products because they take "optional" as "mandatory" which requires the user to install a certificate manually before he/she can access your site. Avoid this unless that is what you actually want. The correct value in most normal cases is "none".

Here is the config that eventually score me an "A" grade from SSLLabs (change "[" and "]" to less-than and greater-than)...

[Connector port="9443"
protocol="HTTP/1.1"
SSLEnabled="true"
maxThreads="150"
scheme="https"
secure="true"
URIEncoding="UTF-8"
SSLCertificateFile="${catalina.base}/conf/ssl/my-certificate.crt"
SSLCertificateKeyFile="${catalina.base}/conf/ssl/privateKey.key"
SSLCertificateChainFile="${catalina.base}/conf/ssl/my-chain-file.crt"
SSLVerifyClient="none"
SSLProtocol="all -SSLv2 -SSLv3"
SSLCipherSuite="ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA:ECDHE-ECDSA-AES128-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA256:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA"
SSLHonorCipherOrder="on"
][/Connector]

Note that the "dhparams" file mentioned in the SSLLabs docs relating to this is appended onto the end of the my-certificate.crt file and the libtcnative-1 library upgraded to version 1.1.34 (by compiling from source).