title: SSL connection error with Tomcat
body: <p>We've been getting random SSL errors lately with one of our two production servers.  Both are configured the same in Tomcat, however one is running 7.0.59, and the other is 7.0.57. </p>
  
  <p>The 7.0.59 server is running fine, however we find the 7.0.57 box randomly stops working, and throws an "SSL connection error", there's no errors in Tomcat.  We don't run Tomcat through Apache, it's standalone.   Often a reboot will allow it to work from days to hours, but eventually it almost always goes back to the error.</p>
  
  <p>Hoping some of you folks have encountered something similar, as I'm stumped.     Our configuration for the host is below:</p>
  
  <pre><code>&lt;Connector
  port="443"
  protocol="HTTP/1.1"
  URIEncoding="UTF-8"
  SSLEnabled="true"
  maxThreads="150"
  scheme="https" secure="true"
  clientAuth="false"
  sslEnabledProtocols="TLSv1, TLSv1.1, TLSv1.2"
  ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA,TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_BC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA"
  keystoreFile="/opt/*********.keystore"
  keystorePass="*********"
  compression="on"
  compressionMinSize="2048"
  noCompressionUserAgents="gozilla, traviata"
  compressableMimeType="text/html, text/xml,text/css,text/plain,text/javascript,application/javascript"
  /&gt;
  </code></pre>
  
  <p>Update Oct 15th:
  We had the error again so I ran a SSLPoke against it when it was fine, and when it was failing.  It would appear to be TLS1 that is failing, I'm going to continue researching it, and I'll report back what I find.  As noted above, a reboot of Tomcat resolves it for a while.  The following is the exception:</p>
  
  <pre><code>[Raw read]: length = 5
  0000: 15 03 01 00 02                                     .....
  [Raw read]: length = 2
  0000: 02 50                                              .P
  main, READ: TLSv1 Alert, length = 2
  main, RECV TLSv1 ALERT:  fatal, internal_error
  main, called closeSocket()
  main, handling exception: javax.net.ssl.SSLException: Received fatal     alert: internal_error
  javax.net.ssl.SSLException: Received fatal alert: internal_error
  at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
  at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
  at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1979)
  at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1086)
  at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1332)
  at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:709)
  at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:122)
  at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:136)
  at SSLPoke.main(SSLPoke.java:26)
  </code></pre>
  
  <p>Update 2:   Still occuring randomly, a reboot will typically make it subside for a few hours to days.   We have upgraded Ubuntu, and JAva.  I think next steps might be to update Openssl.   Of note, we're using a wildcard certificate issued by Geotrust SSL CA - G3.</p>
  
  <p>JAva: 1.8.0_60-b27
  Ubuntu: 14.04
  OpenSSL: 1.0.1f</p>
  
  <p>Openssl output:</p>
  
  <pre><code>openssl s_client -debug -connect vha.pixalere.com:443 -tls1
  CONNECTED(00000003)
  write to 0x181fd40 [0x1829873] (203 bytes =&gt; 203 (0xCB))
  0000 - 16 03 01 00 c6 01 00 00-c2 03 01 c9 53 e7 f0 f8     ............S...
  0010 - fb 2d 23 d5 90 c7 18 ce-2a 40 7b 53 f8 3a c7 2a   .-#.....*@{S.:.*
  0020 - e3 2a e5 8f 0e 5e 78 60-2c 54 e9 00 00 50 c0 14   .*...^x`,T...P..
  0030 - c0 0a 00 39 00 38 00 88-00 87 c0 0f c0 05 00 35   ...9.8.........5
  0040 - 00 84 c0 12 c0 08 00 16-00 13 c0 0d c0 03 00 0a   ................
  0050 - c0 13 c0 09 00 33 00 32-00 9a 00 99 00 45 00 44   .....3.2.....E.D
  0060 - c0 0e c0 04 00 2f 00 96-00 41 c0 11 c0 07 c0 0c   ...../...A......
  0070 - c0 02 00 05 00 04 00 15-00 12 00 09 00 ff 01 00   ................
  0080 - 00 49 00 0b 00 04 03 00-01 02 00 0a 00 34 00 32   .I...........4.2
  0090 - 00 0e 00 0d 00 19 00 0b-00 0c 00 18 00 09 00 0a   ................
  00a0 - 00 16 00 17 00 08 00 06-00 07 00 14 00 15 00 04   ................
  00b0 - 00 05 00 12 00 13 00 01-00 02 00 03 00 0f 00 10   ................
  00c0 - 00 11 00 23 00 00 00 0f-00 01 01                  ...#.......
  read from 0x181fd40 [0x1825323] (5 bytes =&gt; 5 (0x5))
  0000 - 15 03 01 00 02                                    .....
  read from 0x181fd40 [0x1825328] (2 bytes =&gt; 2 (0x2))
  0000 - 02 50                                             .P
  140152556336784:error:14094438:SSL routines:SSL3_READ_BYTES:tlsv1   alert  internal error:s3_pkt.c:1262:SSL alert number 80
  140152556336784:error:1409E0E5:SSL routines:SSL3_WRITE_BYTES:ssl handshake failure:s3_pkt.c:598:
  </code></pre>
  
  <p>After a reboot, a successful openssl looks like below:</p>
  
  <pre><code>SSL handshake has read 4662 bytes and written 417 bytes
  ---
  New, TLSv1/SSLv3, Cipher is ECDHE-RSA-DES-CBC3-SHA
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
  Protocol  : TLSv1.1
  Cipher    : ECDHE-RSA-DES-CBC3-SHA
  Session-ID:   56291324C8EF43A63315534271E5C656EFF45E9503385BF5E0E16820F19FB6E8
  Session-ID-ctx: 
  Master-Key:  75A4D8853F689CC103147B738B404F63E5E2FBA54E8B6CA7E6868E6AD9590255AA95C25A4643A71EEBED048584653253
  Key-Arg   : None
  PSK identity: None
  PSK identity hint: None
  SRP username: None
  Start Time: 1445532377
  Timeout   : 7200 (sec)
  Verify return code: 19 (self signed certificate in certificate chain)
  </code></pre>