title: Tomcat: TLSv1.2 with strong ciphers not working
body: <p>I installed Tomcat-7, <strong>configured support for TLSv1.2</strong> on port 8443. <br />
  My Connector configuration: <br />
  protocol="org.apache.coyote.http11.Http11NioProtocol" SSLEnabled="true" scheme="https" secure="true" sslProtocol="TLSv1.2" sslEnabledProtocols="TLSv1.2"</p>
  
  <p>I then configured a list of strong ciphers I wanted to use.
  TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 <br />
  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 <br />
  TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 <br />
  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 <br /></p>
  
  <p>As I have read, Tomcat can either use Java JSSE or OpenSSL <br />
  JSSE    protocol="org.apache.coyote.http11.Http11NioProtocol" <br />
  OpenSSL protocol="org.apache.coyote.http11.Http11AprProtocol" <br />
  My tomcat connector is configured with JSSE protocol.</p>
  
  <p>It works if I add the following ciphers with SHA1. (No GCM with SHA1)
  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA <br />
  TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA. <br /></p>
  
  <p>I have downloaded the Java cryptographic extensions policy files. 
  Tried with both Java 7 and Java 8.</p>
  
  <p>Before I installed the Cryptographic Extensions I got the following error while starting up Tomcat</p>
  
  <pre><code>INFO: Initializing ProtocolHandler ["http-nio-8443"]
  mai 20, 2014 3:57:43 PM org.apache.tomcat.util.net.jsse.JSSESocketFactory     getEnableableCiphers
  WARNING: None of the ciphers specified are supported by the SSL engine :     TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  </code></pre>
  
  <p>According to Java 7 Documentation all these strong ciphers with GCM-SHA384 and CBC-SHA384 should be supported:
  <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#ciphersuites" rel="nofollow">http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#ciphersuites</a></p>
  
  <p>If I change the ciphers just a little bit:</p>
  
  <pre><code>INFO: Initializing ProtocolHandler ["http-nio-8443"]
  mai 20, 2014 4:21:11 PM org.apache.tomcat.util.net.jsse.JSSESocketFactory getEnableableCiphers
  WARNING: None of the ciphers specified are supported by the SSL engine : TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA584,TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA584,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA584,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA584
  </code></pre>
  
  <p>That would indicate that that my list of ciphers are supported by my Tomcat/Java.</p>
  
  <p>Could the problem be with the Browser? I have tried the latest Chromium and Firefox. After checking some commits I found out that Chromium does support SHA256, SHA384 and AES-GCM.</p>