Question : How do I setup Tomcat (5) to require\force 128-bit encryption at the browser level, or drop the connection? SSL

I have a requirement to setup Tomcat (version 5) so that it forces the client browser to connect at 128-bit encryption, or drop the connection all together.  I already have SSL successfully setup, I just need to configure this last piece somehow to enforce this level of encryption.  Upgrading to tomcat 6 isn't really an option, however if this is only doable in that version, I would still like to know how that is done and maybe we can force the issue.

With IIS this is a simple checkbox, however I am at a loss as to how I can accomplish this same feat in Tomcat.  IIS redirect is also not an option at this moment in time.

Answer : How do I setup Tomcat (5) to require\force 128-bit encryption at the browser level, or drop the connection? SSL

In your server.xml just add suitable ciphers= and sslProtocol= entries e.g.


Restart tomcat, then check if your sill supporting any weak (<128 bit) Ciphers, by typing the following at a command prompt (Or Dos Prompt if you download the tool):

openssl s_client -connect aaa.bbb.ccc.ddd:443 -ssl2
openssl s_client -connect aaa.bbb.ccc.ddd:443 -ssl3 -cipher LOW

Where: aaa.bbb.ccc.ddd  is either you Website's hostname or IP.