title: tomcat 7 + ssl not working - ERR_SSL_VERSION_OR_CIPHER_MISMATCH
body: <p>Ubuntu 14, tomcat 7, java 7</p>
  
  <p>our.crt, our.key and gd_bundle-g2-g1.crt supplied by godaddy.  The bundle has 3 certs in it (as seen by vi'ing the file).</p>
  
  <p>Note, our key and crt were used on node.js without issue.</p>
  
  <p>we created a keystore from the existing crt thusly:</p>
  
  <pre><code>cd /etc/ssl
  openssl pkcs12 -export -in our.crt -inkey our.key -out our.p12 -name tomcat -CAfile gd_bundle-g2-g1.crt -caname root -chain
  </code></pre>
  
  <p>The server.xml is this:</p>
  
  <pre><code>&lt;Server port="8005" shutdown="SHUTDOWN"&gt;
  
  &lt;Listener className="org.apache.catalina.core.JasperListener" /&gt;
  &lt;Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" /&gt;
  &lt;Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" /&gt;
  &lt;Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" /&gt;
  
  
  
  &lt;GlobalNamingResources&gt;
  &lt;Resource name="UserDatabase" auth="Container"
            type="org.apache.catalina.UserDatabase"
            description="User database that can be updated and saved"
            factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
            pathname="conf/tomcat-users.xml" /&gt;
  &lt;/GlobalNamingResources&gt;
  
  
  &lt;Service name="Catalina"&gt;
  
  &lt;Connector port="80" protocol="HTTP/1.1"
             connectionTimeout="20000"
             URIEncoding="UTF-8"
             redirectPort="8443" /&gt;
  
  &lt;Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
             maxThreads="200" scheme="https" secure="true"
             keystoreType="PKCS12"
             keystoreFile="/etc/ssl/our.p12" keystorePass=""
             clientAuth="false" sslProtocol="TLS" /&gt;
  </code></pre>
  
  <ul>
  <li>Tomcat starts up with no errors.</li>
  <li>The webapp works fine on port 80.</li>
  <li>The server has no fw running.</li>
  </ul>
  
  <p>We setup a local redirect from 443 to 8443:</p>
  
  <pre><code>iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443
  </code></pre>
  
  <p>Then try <a href="https://www.ourserver.com/ourapp" rel="noreferrer">https://www.ourserver.com/ourapp</a></p>
  
  <p>Chrome gives: ERR_SSL_VERSION_OR_CIPHER_MISMATCH</p>
  
  <p>curl examples running on local machine:</p>
  
  <pre><code>curl -Iv https://www.ourserver.com:8443
  * Rebuilt URL to: https://www.ourserver.com:8443/
  * Hostname was NOT found in DNS cache
  *   Trying 1xxxxxxxx...
  * Connected to www.ourserver.com (1xxxx) port 8443 (#0)
  * successfully set certificate verify locations:
  *   CAfile: none
    CApath: /etc/ssl/certs
  * SSLv3, TLS handshake, Client hello (1):
  * SSLv3, TLS alert, Server hello (2):
  * error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
  * Closing connection 0
  curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
  </code></pre>
  
  <p>Any ideas?</p>
  
  <p>UPDATE 1</p>
  
  <p>I tried setting up a new tomcat 7 on a new server, and installed a fresh copy of the certs, and got the same error.</p>