Red Hat Bugzilla – Bug 1277389
Default values for secure-socket-protocol parameters in rhq-server.properties and standalone-full.xml need updated to a valid protocol
Last modified: 2016-10-31 21:42:35 EDT
Description of problem:
Currently, security.secure-socket-protocol parameters from rhq-server.properties file are set as:
This worked fine in all versions until JBoss ON 3.3.4. However, in JBoss ON 3.3.4, protocol without version is not accepted any more.
So, above "TLS" value should be replaced with "TLSv1,TLSv1.1,TLSv1.2".
Version-Release number of selected component (if applicable):
JBoss ON 3.3.4
Steps to Reproduce:
1. Install JBoss ON 3.3.0;
2. Try to navigate to https://<jon-server-ip>:7443 and confirm that this works fine;
3. Upgrade to JBoss ON 3.3.4
4. Navigate to https://<jon-server-ip>:7443 and confirm that this failed.
Attempt to log in using https and 7443 port fails and on Firefox the following error is shown ssl_error_no_cypher_overlap. The same attempt on Chrome fails with ERR_SSL_VERSION_OR_CIPHER_MISMATCH error.
No error is thrown and attempt to log in using https and 7443 works fine.
Please note that the actual defaults are defined in standalone-full.xml provided by the JBoss ON server installer. The defaults in standalone-full.xml need to be updated.
In addition, the values are also explicitly re-set in the default rhq-server.properties file. Therefore, the explicit settings need updated as well.
Simeon, is this standalone-full.xml coming from productization EAP 6.4 part?
Moving to ON_QA as available to test with the following brew build:
JON Cumulative patch build: https://brewweb.devel.redhat.com/buildinfo?buildID=469635
*Note: jon-server-patch-3.3.0.GA.zip maps to DR01 build of jon-server-3.3.0.GA-update-05.zip.
Reproduced in steps with parameters:
unzipped from jon-server-3.3.0.GA.zip
(edit by hands)
<entry key="rhq.communications.connector.transport" value="sslsocket" />
<entry key="rhq.agent.server.transport" value="sslservlet" />
<entry key="rhq.agent.server.bind-port" value="7443" />
bin/rhqctl.sh install --start
first check of https://10.16.23.123:7443/
unzip from jon-server-patch-3.3.0.GA.zip -> jon-server-3.3.0.GA-update-05/
second check of https://10.16.23.123:7443/
BINGO: No error is thrown and attempt to log in using https and 7443 works fine.
RESOLUTION -> VERIFIED
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.