WebLogic 10.3.5 TLS 1.1 and 1.2
Hello
I am facing a problem in Weblogic 10.3.5 to communicate with an endpoint Service Salesforce using TLS 1.1 and 1.2. Basically our application consuming SOAP services in FORCE.com, which in turn is now disable support of TLSv1.0. This activity Salesforce provided endpoint test that we can use to validate our implementation agreement go live. As far as I understand TLSv1.1 and TLSv1.2 are only supported by JDK7 I installed the JDK and tried to do some tests:
Test - 1 Simple Java application:
java.lang.System.setProperty("https.protocols", "TLSv1.1");
java.lang.System.setProperty("javax.net.debug", "ssl");
try {
ConnectorConfig config = new ConnectorConfig();
config.setUsername("xxx");
config.setPassword("xxx");
config.setAuthEndpoint("https://tls1test.salesforce.com/services/Soap/c/32.0");
EnterpriseConnection connection = Connector.newConnection(config);
connection.logout();
} catch (Exception e) {
e.printStackTrace();
}
It works quite well.
Test 2 - in weblogic
I replaced the OOB jdk1.6 for a jdk1.7 (by changing the JAVA_HOME parameter in setDomainEnv), I see that the configuration is correct because Weblogic registers the JDK used when starting.
Always in setDomainEnv, I added the following WebLogic options as described in a support article that I found on metalink #.
-Dweblogic.security.SSL.protocolVersion=TLS1 -Dweblogic.security.SSL.minimumProtocolVersion=TLSv1.1 -Djavax.net.debug=all
In fact the first configuration is ignored because I updated the minimumPtocoloVersion TLSv1.1.
I also enabled the JSSE in the console and restarted the server
Finally, I cooked up a trivial ADF application that displays a button. When the user clicks the button, the code above is run but in this case, I got the following exception:
com.sforce.ws.ConnectionException: Failed to send request to https://tls1test.salesforce.com/services/Soap/c/32.0 at com.sforce.ws.transport.SoapConnection.send(SoapConnection.java:121) at com.sforce.soap.enterprise.EnterpriseConnection.login(EnterpriseConnection.java:1094) at com.sforce.soap.enterprise.EnterpriseConnection.<init>(EnterpriseConnection.java:365) at com.sforce.soap.enterprise.Connector.newConnection(Connector.java:27) at view.TestController.testConnection(TestController.java:29) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57) at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.lang.reflect.Method.invoke(Method.java:606) at com.sun.el.parser.AstValue.invoke(Unknown Source) at com.sun.el.MethodExpressionImpl.invoke(Unknown Source) at org.apache.myfaces.trinidadinternal.taglib.util.MethodExpressionMethodBinding.invoke(MethodExpressionMethodBinding.java:53) at org.apache.myfaces.trinidad.component.UIXComponentBase.broadcastToMethodBinding(UIXComponentBase.java:1415) at org.apache.myfaces.trinidad.component.UIXCommand.broadcast(UIXCommand.java:183) at javax.faces.component.UIViewRoot.broadcastEvents(UIViewRoot.java:475) at javax.faces.component.UIViewRoot.processApplication(UIViewRoot.java:756) at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._invokeApplication(LifecycleImpl.java:957) at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl._executePhase(LifecycleImpl.java:427) at oracle.adfinternal.view.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:207) at javax.faces.webapp.FacesServlet.service(FacesServlet.java:265) at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227) at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125) at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:300) at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:26) at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56) at oracle.adf.share.http.ServletADFFilter.doFilter(ServletADFFilter.java:71) at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56) at oracle.adfinternal.view.faces.webapp.rich.RegistrationFilter.doFilter(RegistrationFilter.java:128) at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:446) at oracle.adfinternal.view.faces.activedata.AdsFilter.doFilter(AdsFilter.java:60) at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl$FilterListChain.doFilter(TrinidadFilterImpl.java:446) at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl._doFilterImpl(TrinidadFilterImpl.java:271) at org.apache.myfaces.trinidadinternal.webapp.TrinidadFilterImpl.doFilter(TrinidadFilterImpl.java:177) at org.apache.myfaces.trinidad.webapp.TrinidadFilter.doFilter(TrinidadFilter.java:92) at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56) at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119) at java.security.AccessController.doPrivileged(Native Method) at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:324) at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:460) at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103) at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171) at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71) at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56) at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:163) at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56) at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27) at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:56) at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3715) at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3681) at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321) at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120) at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2277) at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2183) at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1454) at weblogic.work.ExecuteThread.execute(ExecuteThread.java:209) at weblogic.work.ExecuteThread.run(ExecuteThread.java:178) Caused by: javax.net.ssl.SSLException: Received fatal alert: handshake_failure at sun.security.ssl.Alerts.getSSLException(Alerts.java:208) at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1639) at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1607) at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1776) at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1068) at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:890) at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:764) at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624) at weblogic.security.SSL.jsseadapter.JaSSLEngine$4.run(JaSSLEngine.java:118) at weblogic.security.SSL.jsseadapter.JaSSLEngine.doAction(JaSSLEngine.java:732) at weblogic.security.SSL.jsseadapter.JaSSLEngine.unwrap(JaSSLEngine.java:116) at weblogic.socket.JSSEFilterImpl.doHandshake(JSSEFilterImpl.java:93) at weblogic.socket.JSSEFilterImpl.doHandshake(JSSEFilterImpl.java:59) at weblogic.socket.JSSEFilterImpl.write(JSSEFilterImpl.java:391) at weblogic.socket.JSSESocket$JSSEOutputStream.write(JSSESocket.java:78) at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82) at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140) at java.io.FilterOutputStream.flush(FilterOutputStream.java:140) at weblogic.net.http.HttpURLConnection.writeRequests(HttpURLConnection.java:162) at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:376) at weblogic.net.http.SOAPHttpsURLConnection.getInputStream(SOAPHttpsURLConnection.java:37) at com.sforce.ws.transport.JdkHttpTransport.getContent(JdkHttpTransport.java:200) at com.sforce.ws.transport.SoapConnection.send(SoapConnection.java:97) ... 55 more
SSL debug output is:
trigger seeding of SecureRandom
done seeding SecureRandom
Using SSLEngineImpl.
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Using SSLEngineImpl.
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
%% No cached client session
*** ClientHello, TLSv1
RandomCookie: GMT: 1446412456 bytes = { 57, 183, 59, 74, 115, 241, 243, 92, 106, 13, 106, 176, 21, 229, 253, 50, 11, 239, 164, 20, 203, 183, 96, 241, 3, 135, 165, 61 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods: { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
***
[write] MD5 and SHA1 hashes: len = 149
0000: 01 00 00 91 03 01 56 37 81 A8 39 B7 3B 4A 73 F1 ......V7..9.;Js.
0010: F3 5C 6A 0D 6A B0 15 E5 FD 32 0B EF A4 14 CB B7 .\j.j....2......
0020: 60 F1 03 87 A5 3D 00 00 2A C0 09 C0 13 00 2F C0 `....=..*...../.
0030: 04 C0 0E 00 33 00 32 C0 08 C0 12 00 0A C0 03 C0 ....3.2.........
0040: 0D 00 16 00 13 C0 07 C0 11 00 05 C0 02 C0 0C 00 ................
0050: 04 00 FF 01 00 00 3E 00 0A 00 34 00 32 00 17 00 ......>...4.2...
0060: 01 00 03 00 13 00 15 00 06 00 07 00 09 00 0A 00 ................
0070: 18 00 0B 00 0C 00 19 00 0D 00 0E 00 0F 00 10 00 ................
0080: 11 00 02 00 12 00 04 00 05 00 14 00 08 00 16 00 ................
0090: 0B 00 02 01 00 .....
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', WRITE: TLSv1 Handshake, length = 149
[Raw write]: length = 154
0000: 16 03 01 00 95 01 00 00 91 03 01 56 37 81 A8 39 ...........V7..9
0010: B7 3B 4A 73 F1 F3 5C 6A 0D 6A B0 15 E5 FD 32 0B .;Js..\j.j....2.
0020: EF A4 14 CB B7 60 F1 03 87 A5 3D 00 00 2A C0 09 .....`....=..*..
0030: C0 13 00 2F C0 04 C0 0E 00 33 00 32 C0 08 C0 12 .../.....3.2....
0040: 00 0A C0 03 C0 0D 00 16 00 13 C0 07 C0 11 00 05 ................
0050: C0 02 C0 0C 00 04 00 FF 01 00 00 3E 00 0A 00 34 ...........>...4
0060: 00 32 00 17 00 01 00 03 00 13 00 15 00 06 00 07 .2..............
0070: 00 09 00 0A 00 18 00 0B 00 0C 00 19 00 0D 00 0E ................
0080: 00 0F 00 10 00 11 00 02 00 12 00 04 00 05 00 14 ................
0090: 00 08 00 16 00 0B 00 02 01 00 ..........
[Raw read]: length = 5
0000: 15 03 01 00 02 .....
[Raw read]: length = 2
0000: 02 28 .(
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', READ: TLSv1 Alert, length = 2
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', RECV TLSv1 ALERT: fatal, handshake_failure
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: handshake_failure
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: handshake_failure
Using SSLEngineImpl.
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Using SSLEngineImpl.
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
%% No cached client session
*** ClientHello, TLSv1
RandomCookie: GMT: 1446412456 bytes = { 254, 68, 8, 140, 41, 178, 180, 174, 17, 206, 29, 189, 43, 201, 52, 128, 168, 107, 8, 52, 189, 56, 89, 158, 130, 76, 34, 225 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods: { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
***
[write] MD5 and SHA1 hashes: len = 149
0000: 01 00 00 91 03 01 56 37 81 A8 FE 44 08 8C 29 B2 ......V7...D..).
0010: B4 AE 11 CE 1D BD 2B C9 34 80 A8 6B 08 34 BD 38 ......+.4..k.4.8
0020: 59 9E 82 4C 22 E1 00 00 2A C0 09 C0 13 00 2F C0 Y..L"...*...../.
0030: 04 C0 0E 00 33 00 32 C0 08 C0 12 00 0A C0 03 C0 ....3.2.........
0040: 0D 00 16 00 13 C0 07 C0 11 00 05 C0 02 C0 0C 00 ................
0050: 04 00 FF 01 00 00 3E 00 0A 00 34 00 32 00 17 00 ......>...4.2...
0060: 01 00 03 00 13 00 15 00 06 00 07 00 09 00 0A 00 ................
0070: 18 00 0B 00 0C 00 19 00 0D 00 0E 00 0F 00 10 00 ................
0080: 11 00 02 00 12 00 04 00 05 00 14 00 08 00 16 00 ................
0090: 0B 00 02 01 00 .....
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', WRITE: TLSv1 Handshake, length = 149
[Raw write]: length = 154
0000: 16 03 01 00 95 01 00 00 91 03 01 56 37 81 A8 FE ...........V7...
0010: 44 08 8C 29 B2 B4 AE 11 CE 1D BD 2B C9 34 80 A8 D..).......+.4..
0020: 6B 08 34 BD 38 59 9E 82 4C 22 E1 00 00 2A C0 09 k.4.8Y..L"...*..
0030: C0 13 00 2F C0 04 C0 0E 00 33 00 32 C0 08 C0 12 .../.....3.2....
0040: 00 0A C0 03 C0 0D 00 16 00 13 C0 07 C0 11 00 05 ................
0050: C0 02 C0 0C 00 04 00 FF 01 00 00 3E 00 0A 00 34 ...........>...4
0060: 00 32 00 17 00 01 00 03 00 13 00 15 00 06 00 07 .2..............
0070: 00 09 00 0A 00 18 00 0B 00 0C 00 19 00 0D 00 0E ................
0080: 00 0F 00 10 00 11 00 02 00 12 00 04 00 05 00 14 ................
0090: 00 08 00 16 00 0B 00 02 01 00 ..........
[Raw read]: length = 5
0000: 15 03 01 00 02 .....
[Raw read]: length = 2
0000: 02 28 .(
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', READ: TLSv1 Alert, length = 2
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', RECV TLSv1 ALERT: fatal, handshake_failure
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: handshake_failure
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: handshake_failure
Using SSLEngineImpl.
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Using SSLEngineImpl.
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
%% No cached client session
*** ClientHello, TLSv1
RandomCookie: GMT: 1446412456 bytes = { 26, 201, 221, 59, 172, 198, 4, 9, 206, 99, 69, 250, 185, 181, 202, 82, 141, 46, 150, 192, 47, 187, 167, 115, 148, 91, 3, 91 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods: { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
***
[write] MD5 and SHA1 hashes: len = 149
0000: 01 00 00 91 03 01 56 37 81 A8 1A C9 DD 3B AC C6 ......V7.....;..
0010: 04 09 CE 63 45 FA B9 B5 CA 52 8D 2E 96 C0 2F BB ...cE....R..../.
0020: A7 73 94 5B 03 5B 00 00 2A C0 09 C0 13 00 2F C0 .s.[.[..*...../.
0030: 04 C0 0E 00 33 00 32 C0 08 C0 12 00 0A C0 03 C0 ....3.2.........
0040: 0D 00 16 00 13 C0 07 C0 11 00 05 C0 02 C0 0C 00 ................
0050: 04 00 FF 01 00 00 3E 00 0A 00 34 00 32 00 17 00 ......>...4.2...
0060: 01 00 03 00 13 00 15 00 06 00 07 00 09 00 0A 00 ................
0070: 18 00 0B 00 0C 00 19 00 0D 00 0E 00 0F 00 10 00 ................
0080: 11 00 02 00 12 00 04 00 05 00 14 00 08 00 16 00 ................
0090: 0B 00 02 01 00 .....
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', WRITE: TLSv1 Handshake, length = 149
[Raw write]: length = 154
0000: 16 03 01 00 95 01 00 00 91 03 01 56 37 81 A8 1A ...........V7...
0010: C9 DD 3B AC C6 04 09 CE 63 45 FA B9 B5 CA 52 8D ..;.....cE....R.
0020: 2E 96 C0 2F BB A7 73 94 5B 03 5B 00 00 2A C0 09 .../..s.[.[..*..
0030: C0 13 00 2F C0 04 C0 0E 00 33 00 32 C0 08 C0 12 .../.....3.2....
0040: 00 0A C0 03 C0 0D 00 16 00 13 C0 07 C0 11 00 05 ................
0050: C0 02 C0 0C 00 04 00 FF 01 00 00 3E 00 0A 00 34 ...........>...4
0060: 00 32 00 17 00 01 00 03 00 13 00 15 00 06 00 07 .2..............
0070: 00 09 00 0A 00 18 00 0B 00 0C 00 19 00 0D 00 0E ................
0080: 00 0F 00 10 00 11 00 02 00 12 00 04 00 05 00 14 ................
0090: 00 08 00 16 00 0B 00 02 01 00 ..........
[Raw read]: length = 5
0000: 15 03 01 00 02 .....
[Raw read]: length = 2
0000: 02 28 .(
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', READ: TLSv1 Alert, length = 2
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', RECV TLSv1 ALERT: fatal, handshake_failure
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: handshake_failure
[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: handshake_failure
FORCE connection exception!
What I really don't understand, is why the SSL client attempts to use the TLSv1 instead of TLSv1.1.
*** ClientHello, TLSv1 [ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', READ: TLSv1 Alert, length = 2 [ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', RECV TLSv1 ALERT: fatal, handshake_failure [ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: handshake_failure [ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: handshake_failure FORCE connection exception!
I also tried to install salesforce test certificate in the keystore, but I had no luck. Could someone please help me with this issue?
I have a feeling that certain configurations of WLS is not working properly and the application server always use the poor implementation.
Thank you
Hello.
With regard to my understanding Doc ID 1936300.1 mentioned compliance with TLS1.1 + for WLS starting by 10.3.6. Docs for 10.3.5 has weblogic.security.SSL.protocolVersion setting but not weblogic.security.SSL.minimumProtocolVersion not mentioned. At least for the basic version (without jobs). I could be wrong, but it seems that 10.3.5 does not support TLS1.1 +.
Tags: Fusion Middleware
Similar Questions
-
Office distance, MSSQL and TLS 1.0 and RC4 encryption algorithms
Currently, SSL Labs suggests that SSL RC4 encryption algorithms are low, and that to always mitigate the attack of the BEAST in older clients, TLS 1.0 can be disabled.
I've read the threads which set out that MS SQL server had problems when SSL 3.0 and TLS 1.0 have been disabled, and also this turning off TLS 1.0 would break Remote Desktop (which this thread seems State requires TLS 1.0 and RC4 ciphers: https://msdn.microsoft.com/en-us/library/aa383015%28v=vs.85%29.aspx)
See also:
- https://TechNet.Microsoft.com/en-us/magazine/ff458357.aspx and
- https://social.technet.Microsoft.com/forums/en-us/e2b22dad-bb0c-4059-BEEC-6673783ab777/remote-desktop-stopped-working-after-disabling-SSL-20-and-TLS-10
Is it possible to have a Windows Server 2012, which is fully patched, rely on a plu TLS encryption algorithm versions than 1.0 and the MCG (or other)?
If the answer is that TLS 1.0 and RC4 must be enabled for authentication of network layer, can offer you a better order of practical cipher who would score high enough on ssl labs?
SSL3.0 and TLS 1.0 can be turned off the coast and have always start MS SQL 2012 (not configured to use SSL connections/sql ssl certificate)?
Thanks for any input that you are able to give.
This issue is beyond the scope of this site and must be placed on Technet or MSDN
-
WinHTTP.dll does not work with TLS 1.1 and TLS 1.2
We cannot send https requests to our payment processors using windows 7 with winhttp.dll or msxml6.dll because it is not support TLS 1.1 and TLS 1.2
on Windows 7 and windows 2008 R2 server I have the same version of winHTTP.dll 6.1.7601.17514;
winHTTP.dll version 6.1.7601.17514 does not work with TLS1.1 and TLS 1.2
WindowsServer 8.1 and windows 2012 I have winHTTP.dll version 6.2.9200.16451
winHTTP.dll version 6.2.9200.16451 works wellHere is a sample of my test code:
Set obj = CreateObject ("WinHttp.WinHttpRequest.5.1")
obj. Open "COMPUTER", "https://www.paymnt.com/".
obj. SetTimeouts 30000, 60000, 60000, 60000
obj. SetRequestHeader 'Content-Type', ' application/x-www-formulaires-urlencoded.
obj. Option (6) = false ' disable redirects
obj. Option (9) = 512' force TLS 1.1 - error
"obj. Option (9) = 2048' force TLS 1.2 - errorHow can we improve the winhttp.dll version or msxml6.dll in windows 7 to work with TLS 1.1 and TLS 1.2?
This is the e eprint screen with winHTTP.dll version 6.1.7601.17514
This issue is beyond the scope of this site (for consumers) and to be sure, you get the best (and fastest) reply, we have to ask either on Technet (for IT Pro) or MSDN (for developers)* -
4.2 of the ACS and EAP - TLS with AD and prefix problem
Hello
We have the following situation:
-2 X ACS (ACS SE 4.2 1 x and 1 x 4.2 ACS) for domain
-2 x ACS (ACS SE 4.2 1 x and 1 x 4.2 ACS) for domain b.
First of all, there is a problem to have an ACS SE and a CBS work together for an area, I do not? When we haven't had that one area and the two SE ACS were responsible for domain A, it worked.
Now after the changes, authentication of machine with EAP - TLS is no longer in effect. In the newspapers, it always says that "external user DB is unknown" for a username (machine) as host/abc.domain.ch
This is the normal output of the Remote Agent, he finds the host but then nothing happens:
CSWinAgent 2009-11-30 16:32:13 0140 3672 0x0 customer who connects from x.x.x.x:2443
CSWinAgent 2009-11-30 16:32:14 0507 3512 0x0 CPP: NT_DSAuthoriseUser received
CSWinAgent 2009-11-30 16:32:14 0474 3512 0x0 NTLIB: Creating Domain cache
CSWinAgent 2009-11-30 16:32:14 0549 3512 0x0 NTLIB: domain Cache loading
CSWinAgent 2009-11-30 16:32:14 0646 NTLIB 3512 0x0: none of the trusted domains found
CSWinAgent 2009-11-30 16:32:14 0735 3512 0x0 NTLIB: cache loaded field
CSWinAgent 2009-11-30 16:32:14 2355 3512 0x0 NTLIB: user "host/abc.domain.ch" found [FIELD]
CSWinAgent 2009-11-30 16:32:14 0584 0 x 3512 0 RPC: NT_DSAuthoriseUser response sentSo I did a test of the ASA to see if the host is a problem (until changes have been made it was not a problem):
AAA authentication RADIUS host 10.3.1.9 username host/abc.domain.ch to test (the ASA becomes the host / entry for the correct Windows scheme with the $):
CSWinAgent 2009-11-30 15:39:23 0140 3672 0x0 customer who connects from x.x.x.x:1509
CSWinAgent 2009-11-30 15:39:23 0390 0 x 3728 0 RPC: NT_MSCHAPAuthenticateUser received
CSWinAgent 2009-11-30 15:39:23 0474 3728 0x0 NTLIB: Creating Domain cache
CSWinAgent 2009-11-30 15:39:23 0549 3728 0x0 NTLIB: domain Cache loading
CSWinAgent 2009-11-30 15:39:23 0646 NTLIB 3728 0x0: none of the trusted domains found
CSWinAgent 2009-11-30 15:39:23 0735 3728 0x0 NTLIB: cache loaded field
CSWinAgent 2009-11-30 15:39:23 1762 3728 0x0 NTLIB: had WorkStation CISCO
CSWinAgent 2009-11-30 15:39:23 1763 3728 0x0 NTLIB: Windows authentication attempts for user ABC$
CSWinAgent 2009-11-30 15:39:23 1815 3728 0x0 NTLIB: Windows authentication FAILED (Error 1326 L)
CSWinAgent 2009-11-30 15:39:23 0373 3728 0x0 NTLIB: retry authentication to the domain
CSWinAgent 2009-11-30 15:39:23 0549 3728 0x0 NTLIB: domain Cache loading
CSWinAgent 2009-11-30 15:39:23 1762 3728 0x0 NTLIB: had WorkStation CISCO
CSWinAgent 2009-11-30 15:39:23 1763 3728 0x0 NTLIB: Windows authentication attempts for user ABC$
CSWinAgent 2009-11-30 15:39:23 1815 3728 0x0 NTLIB: Windows authentication FAILED (Error 1326 L)
CSWinAgent 2009-11-30 15:39:23 0456 0 x 3728 0 RPC: NT_MSCHAPAuthenticateUser response sentIt is clear that the test failed because of the bad 'past to a computer' but it's a different output as before. I saw that in ACS 4.1, you can change the prefix of send_break_action for nothing, but in 4.2 it is no longer possible.
This could be the problem, or if someone sees no other problem?
Best regards
Dominic
Hello
I encounter the same problem with my acs. I have all of the attempts failed for the default group. For the default group made configuration is not available. Is - this thereason behind all this?
-
Machine based authentication using EAP - TLS, MS CA and 5.2 of the ACS
I use ACS 4.2 for Windows for a couple of years now and I'm pretty comfortable with it. 5.2 model is much more different than what I expected. We downloaded the trial in our laboratory for 90 days, and I try to get 802. 1 x wired works so we can be sure that we want to buy it. I've looked everywhere and I have been unable to find some basic instructions on how to configure the following in a step by step process scenario:
1. integrated AD
2 EAP - TLS
3 certificates
4 Microsoft CA
5. the applicant is XP SP 3
6 non-Cisco 802.1 x compatible switches (switches are not the question)
I got GANYMEDE to work fairly easily, but I am confident the issues I have are user based :). Does anyone know of a doc somewhere that goes on a scenario like this (in addition to the user manual and docs of migration ISBN)? Also, we have the assurance of software on our box 4.2 - TAC support questions we have on the 5.2 box while we are it do demonstrations?
Thanks in advance.
Hello, Christopher.
I'll try to give you some tips to achieve what you want.
Additional info can be found in the user guide:
1. in the identity store / Active directory, check "enable machine authentication.
2 import a certificate for ACS
Go to System Administration > Configuration > Local Server Certificates > Local certificates and click the Add button.
Select how you want to import the certificate, and then verify the Protocol EAP
3. Add your switches as aaa clients
Access network resources > network hardware and the AAA Clients, click on create and add configure address IP + shared secret for the RADIUS.
4-go to access policies > Access Services and click on create a new access service.
Select the selected Type of Service and network access in the list.
Verify the identity, group mapping and authorization
5 - go to the access policies > rules of selection and select "Rule based selection result" if not already done, then click Customize at the bottom right of the screen, and then add the properties that allows you to match your device with which you want to do TLS.
You can use the IP address of devices, or you can create a NDG (in network resources), assign devices to the NDG and match this NDG in your rule.
If all your switches RADIUS will make eap - tls, you can change the rule
Rule-1 Ray game Default network access While in the result, you choose your service of access created in step 3.
6 - go to the access policies and click on the access service that you created in step 3. In the allowed Protocols tab, see EAP - TLS
7. unfold your access service menu, and then click identity. Select your ad as being the source of the identity
8. check that the 'Allowed access' rule is selected in the authorization to access your service
These measures define your devices, and then create a rule to say that ACS must use an individual service for this access devices and set this access service to use AD as authentication.
Again, what are the basic steps, he may miss some things to do depending on your configuration, but I hope this will help you.
ACS 5 may be difficult at first, but once you get your hands on it, you will see that it is powerful.
-
Oracle Weblogic domain creation problem with Webcenter portal and the content of the products.
Hello
I tried to create a new domain weblogic support webcenter portal and content products. However, I got the following error on the progression of 70%:
--------------------------------------------------------------------------------------------------------------------------
Preparing...
Extract the contents of field...
Creating new domain security information...
Failed to create in the domain!
Location of area: C:\Oracle\Middleware\user_projects\domains\base_domain
Reason: null
Exception:
Traceback (innermost last):
"< Iostream >" file, line 86, in there?
ImportError: no module named javaos
--------------------------------------------------------------------------------------------------------------------------
Server operating system: Windows Server 2012 R2
FMW Version: 11.1.1.8
Your help would be greatly appreciated.
Thank you
Cyrus
Hello
Did you add the name of your operating system (Windows Server 2012) in the javashell.py file?
After you add the name of your os you must re-create the jython file - modules.jar.
Use after command to generate the jar again
jar - cvf jython - module.jar Lib META_INF (records created after extraction of the jar file)
I have also been facing same problem, solved by above to get around.
-Prashant
-
Can I use the same Weblogic Server for soa suite 11 g and OSB panels?
Hi all
Is it possible to use the same server weblogic for SOA suite 11 and OSB?Hi Arun,
SOA 11 g is running on weblogic version 10.3.2 OSB is running on weblogic 10.3, so you can't have two SOA suite 11 g and the OSB on weblogic even (not EVEN in the two areas of same weblogic). You must have two facilities of weblogic. (at this time)
After the next release of OSB (planned for H2), you can run both the same weblogic.
Kind regards
Anuj -
CISCO Anyconnect and using TLS V1.2
Hello
I ran an anyconnect VPN Service that uses SSLv3, after POODLE, we moved on TLSv1, which worked well, but I have recently been informed that TLSv1 is also vulnerable to POODLE.
I upgraded to the latest version of the software firewall (it is a 5512 ASA) and TLSv1.2 - which stopped the work VPN was allowed, once it has been activated customers started anyconnect have reported that they were behind a captive portal, despite the fact that he is certainly no captive portal. I get the same problem with TLSv1.1 - How can I get this to work - I'm really stuck and not an expert CISCO.
Thank you very much
Hi James,
What is the version of ASA and anyconnect here? Only anyconnect 4.x support TLS 1.2 and ASA 9.3 (2).
http://www.Cisco.com/c/en/us/TD/docs/security/vpn_client/AnyConnect/ANYC...
Kind regards
Kanwal
Note: Please check if they are useful.
-
Administration server and the servers managed (WebLogic Server).
Hello
What are Server Administration and managed servers , I saw these words as I read the installation guide for WebLogic server,
but I don't know what they are?
I saw them while I was reading on the Node manager that allows me to start the above mentioned.
-J' installs the WebLogic to develop applications with oracle reports and forms services.
1 - do I need a node Manager, Administration Server or managed servers?
2. is the Manager nodes, Server Administration or servers managed as EnterPrise data control manager ?
Thank you very much
Answers to most of your questions WLS lie in WLS documentation:
http://docs.Oracle.com/CD/E23943_01/Web.1111/e13752/TOC.htm
However, a simple answer to your questions could be summed up as follows.
If you are familiar with older versions of application server version 10, which include OC4J as its Java container, as a managed WLS server is basically the same thing. In the context of WLS, a managed server is responsible for hosting java applications on the server side. For example, Oracle Forms Servlet. The WLS management server is actually a java application deployed on a managed server. So, really, the "Admin" server is a kind of "Managed Server". In a typical installation of forms/States, you will find that at least three 3 managed servers are created automatically for you:
- Server Admin
- WLS_FORMS
- WLS_REPORTS
Node Manager is a separate process that is used to allow the two directors of the WLS environment such as command line allowing the administrator of the server to communicate with other servers managed, local or remote.
http://docs.Oracle.com/CD/E25178_01/Web.1111/e13740/overview.htm
Then, for simply "run" apply (forms, for example), all you need is the managed server that hosts the forms Servlet. However, if you want to change the configuration via a web interface, you must also run the administration server (and Node Manager).
All these components are much more complex than what I've described here. I would recommend to consider the documentation if you are interested in learning about them. That said, the best way to really learn about them likely will be to install the product and start using it.
-
Oracle Weblogic server and Oracle Application Server
The Bea weblogic and Oracle application server have been combined in a product-viz Oracle Weblogic server.
Please clarify - because Oracle Application Server is always available as a separate offering
Thank youYes, since version 10.3.4 the product called Weblogic Server provides the two "BEA WLS' and 'Oracle AS' characteristics (namely, support for forms and reports, ADF, etc..)
Existing customers of Oracle ACEs can move to Weblogic Server to get its benefits (for example, JRockIt JVM). For the new Oracle AS it is no longer available.
BTW. This is not a good forum for this kind of questions. You must use these: https://forums.oracle.com/forums/category.jspa?categoryID=193
-
Carousel component and stand-alone Weblogic server problem.
Hello! I have a problem after I deployed my application on stand-alone Weblogic Server. There is no error when I do the same local Weblogic Server. So, let's discuss.
My App is deployed to new stand-alone WebLogic Server. I have the page with carousel cpmponent, when I visit I can see: http://my.jetscreenshot.com/2677/20101020-bvow-82kb
When I navigate to another page by pressing the 'BACK' button, then I go to the master/detail page, see: http://my.jetscreenshot.com/2677/20101020-casn-19kb
I see no data in the detailed form, but the data should be there. And when I try to navigate this page with buttons next, previous and so on, then I got an error in the browser, see: http://my.jetscreenshot.com/2677/20101020-cugj-20kb
If I do the same scenario in my local server, then there is no problem.
An interesting thing is that when I restert my stand-alone Weblogic Server and try to visit my pages in different order app - first visit master detail form and him visit my page to view carousel, so I have no errors. And after that I try to get my application by first scenario and no errors. So if I post the stand-alone deployment first visit master/detail form, then carousel. So before my app works well, but if I first visit page carousel after deployment stand-alone weblogic server. Then forward, I have problems as I said.
The problem is the carousel component. If I delete and make the same scenarious on the stand-alone server, then there not a problem as I have menthioned before. ANY ideas what is wrong and why everything works correct on the local server?
If you need more information, please let me know! Moreover, here you can download my App and try to deploy it to your own stand-alone Weblogic Server, app is here: http://www.failiem.lv/down.php?i=fwgzym & n = Test_carousel_in_standalone_weblogic_server.zip
After downloading, run the scripts in the database project (see: http://my.jetscreenshot.com/2677/20101020-akcx-16kb)
And after deploy you my application on STAND-ALONE weblogic server, visit the ViewCarousel.jspx page and in press the 'BACK' button and see what happens.
Hope for your answers, cordially, Debuger!Debuger,
of course, I ran your use case. And it worked on my environment.OK, my guess is that you hit the Bug 9183113. Brief summary, is that if you use createRootApplicationModule (...) outside the binding of the adf, the chances are that you break links to the other parts of the application that use the same definition of application module. In your test cases, you use createRoorApplicationModule (...) to stream image via a servlet in the browser. You use the same definition of application to the ruin of the application module. Sometimes it breaks resulting in the "no data found" links you see.
The work-around, I found as it is to ensure that the servlet you use createRootApplicationModule, runs through the filter adfBindings. It worked for me, so give it a try.
Open your web.xml file, select "Filters" and then in the table "adfBindings". In the tabs below the table select "filter mappings. He see you on entry fro "Faces Servlet". HJit green '+', select 'Servlet' as "Mapping Type", in the column mapping use the drop down arrow and select your 'ImageServletCarousel', 'Distributor Type' column select the checkboxes for 'Before' and 'ask '.
Do the same for other servlets image you use and save your work.
Recompile and build a new EAR and deploy it. See if that fixes your mistake.Timo
-
Controls WebLogic seeks always MSG_BUFFER_QUEUE and MSG_BUFFER_TOPIC
Hello
Whenever we deploy an EAR that uses controls in Weblogic he deployed with a WARNING State and that's because that his search for 2 dynamically generated destinations JMS JNDI in the format of:
WebLogic. < app_name >. WlwRuntimeAppScopedJMS #MSG_BUFFER_QUEUE and
WebLogic. < app_name >. WlwRuntimeAppScopedJMS #MSG_BUFFER_TOPIC
so, the only solution that we currently have is to create these JMS destinations... but since we have a lot of EAR is... his fate to a lame solution... so I was wondering if we deploy theres a way to disable this JNDI research or otherwise, em redirect JMS destinations in order to have only 2 for each EAR...
thnx and best regards,
AndresWell I'll help you, but only because it's Christmas.
In your .xml weblogic application, you probably have a reference to the weblogic-controls library - 10.0. This means that you get also some multilateral banks for development of a jar file in this library (weblogic messagebuffer (mdb) that listens on a queue of specific application-scope and theme. So if your application does not define these queues, the WebLogic will report a warning that these multilateral development banks could not connect to their destination.
I don't know if you can somehow disable the messagebuffer module in the library, or if it's even safe to do. However, I think that the warnings can be ignored, as long as you do not use message buffering. And I know you do not because buffering message, and that's the cool thing, IF you were to use it then WebLogic would automatically created module scope JMS application necessary for you :)
Thus, to enable buffering message, create a new control (for example a process control) with an annotation @EventSet somewhere and place a (enable = true) @MessageBuffer on a method in the control. Then the WLI constructor will do the rest for you when you assemble the application. Also, since you are not going to use the control for something else which allows a treatment at the time to build, you can just see what deployment descriptors are added (wlwRuntime - jms.xml) and modified (weblogic application. (XML) and then just do it manually without creating a new control.
Last thing, if your domain is organized into clusters you will likely get hit by CR294199 on deploy, but there is a solution for these release notes for version 10.3.
Good luck :)
/ Björn -
WebLogic and Oracle RAC + DataGuard
Hello
I'm testing Weblogic 9.2 with Oracle 10g RAC (2 knots) and Oracle DataGuard and trying to find the best possible data source configuration that would deal with load balancing between RAC nodes and failover/switchback between RAC nodes and data pending. The problem I see is that all Oracle instances must be open in order to successfully deploy the data sources on Weblogic. This means that, at the time of the creation/deployment and after every restart WebLogic, all Oracle instances must be upward and running and accept connections, because otherwise the data sources will not be instantiated and therefore not accessible to the consumer application.
Is it possible to smoothly deploy data sources without having to go through the hassle of ensuring all nodes RAC and DataGuard are open?
What I expected, it is that the data source would be instantiated but disabled if no connection is available. Having to redeploy the data source once the database is available again is a limitation regarding transparent high availability.
Thank you.Hi, Yes. Configure the pool to have an initial capacity of zero. Then it will be
deploy and not try to make connections. He'll only try when / if
He is asked at run time. While the DBMS is not passed, the
Data source throws an exception just until the DBMS is in place. -
How can I determine the configuration of TLS/SSL in Firefox ver 38?
I received the following message (partially shown) when I tried to connect to a particular Web site.
The secure connection failed
An error occurred during a connection to xxxxxx.xxx. Cannot communicate securely with counterpart: no common encryption algorithm. (Error code: ssl_error_no_cypher_overlap).
The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.I tried the MS IE browser and had a similar view. I checked the security settings on IE, added TLS 1.1 and 1.2 of TLS selections and solved my problem on the Internet Explorer browser.
So I wanted to check the settings for TLS/SSL on Firefox but couldn't find where they were selected. I thought that they used to be under Tools/Options. Where can I go to check them?
You can post a link to a page accessible to the public (i.e. no authentication or signature required)?
The site may attempt to return to a lower version of TLS in a way that is no longer allowed in current versions or maybe use a deprecated suite of encryption.
You can open the topic: config page through the address bar and use the search bar to locate this pref:
- Security.TLS.insecure_fallback_hosts
You can double-click the line to edit the prefs and add the complete field to the value of this preference.
If there are already websites (domains) in this list, then add a comma and the new domain (without space).
There should be only areas separated by a comma in the column value (example.com,www.example.com).If this help you can contact this Web site and ask them to look into this and update their security.
-
Limit default value of security.tls.version.fallback - version 37
I have read the guidelines and some of the recent questions, but not sure this is a good forum to post my question. Please please use me for a good if necessary.
I noticed that Firefox Beta 37 has the following default values for the TLS configuration that I should always TLS 1.2 for TLS connection even if TLS 1.0 is allowed to use because you can not fall back to TLS 1.0, because the value of limited relief.
Security.TLS.version.Fallback - limit; 3
Security.TLS.version.max; 3
Security.TLS.version.min; 1The values of security.tls.version.max and min is the same as Firefox 36, but security.tls.version.fallback - limit is increased from 1 to 3 in Firefox Beta 37.
Security.TLS.version.fallback will limit; 3 the default configuration in the next version of Firefox 37 official?
Hi hshimoji, the answer is Yes: https://bugzilla.mozilla.org/show_bug.cgi?id=1084025
Maybe you are looking for
-
Updates the window running incessently. What's wrong? BTW, I use Little Snitch but no request
I upgraded to Firefox 5, both until after that update window would act as an update was coming, but it just runs non-stop.I use Little Snitch, who remains on, has however never apply for access authorization highlight. And I can't turn off just in ca
-
They gave me an iPhone 5 c, put in a new SIM card, then set up a new Apple ID. Unfortunately, I didn't know that after the fact, that I should have used the same ID that is on my iPad. I tried to change it (on the iPhone because it has less to this
-
HP 1536dnf: M1536dnf cannot send faxes from charger only from glass.
I can't send faxes to high feeder if I place the fax on the glass. Message I get is always "the fax storage" and the makers of fax to be sent. Updated firmware to date with no solutioin.
-
Selective impression want 5530
I installedthe just want to 5530 on our wireless network and am printing from HP with Windows 8 computers. Had no problem installing and printing documents. Hard to explain, but will use an example. I order a ticket of entertainment of a website a
-
After new XP installed the computer sees my old CD Drive not my new DVD drive
After new XP installed the computer sees my old CD Drive not my new DVD player. My newest DVD burner was in the computer before I did the reformat and install again, but for some reason any my old CD player shows. He is no longer in the machine!