title: How to fix "ssl_error_no_cypher_overlap" on a Tomcat 7 server?
body: <p>The latest versions of Chrome and Firefox have disabled SSLv3.0 by default, due to the <a href="https://www.us-cert.gov/ncas/alerts/TA14-290A" rel="nofollow noreferrer">POODLE vulnerability</a>.   This leads to the following error when I attempt to open a site I have set up (and which was working fine):</p>
  
  <p>With Chrome:  </p>
  
  <pre><code>A secure connection cannot be established because this site uses an unsupported protocol.
  Error code: ERR_SSL_VERSION_OR_CIPHER_MISMATCH
  </code></pre>
  
  <p>With Firefox:</p>
  
  <pre><code>Cannot communicate securely with peer: no common encryption algorithm(s). (Error code: ssl_error_no_cypher_overlap) 
  </code></pre>
  
  <p>I have researched this issue <a href="https://code.google.com/p/chromium/issues/detail?id=451311" rel="nofollow noreferrer">with Chrome</a>, <a href="https://stackoverflow.com/questions/547219/firefox-ssl-error-no-cypher-overlap-error">Firefox</a>, <a href="https://tomcat.apache.org/tomcat-7.0-doc/ssl-howto.html" rel="nofollow noreferrer">Tomcat</a> and <a href="https://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support_-_BIO_and_NIO" rel="nofollow noreferrer">more Tomcat docs</a>.  I understand the problem, but I can't find the documentation to configure Tomcat 7 to use only the TLS ciphers and protocols that are now safe.   I'm not sure if I need to create a new cert/keypair, change my server.xml, or install a new version of Tomcat, or what.   I'm not even sure what versions of cipher/protocol are now considered "acceptable" by these browsers.   Can anyone point me to the docs or an example setup for this?</p>
  
  <p>I'm using OpenJDK 1.7 on Ubuntu 14.04 with Tomcat 7.</p>
  
  <p>Here's my cert file (redacted):</p>
  
  <pre><code>Keystore type: JKS
  Keystore provider: SUN
  
  Your keystore contains 1 entry
  
  Alias name: something
  Creation date: May 4, 2013
  Entry type: PrivateKeyEntry
  Certificate chain length: 1
  Certificate[1]:
  Owner: CN=something, OU=something, O=something, L=something, ST=something, C=something
  Issuer: CN=something, OU=something, O=something, L=something, ST=something, C=something
  Serial number: ...
  Valid from: Sat May 04 17:28:21 MST 2013 until: Tue May 02 17:28:21 MST 2023
  Certificate fingerprints:
       MD5:  ...
       SHA1: ...
       SHA256: ...
       Signature algorithm name: SHA1withDSA
       Version: 3
  </code></pre>
  
  <p>Here's my <code>server.xml</code> entry for HTTPS support:</p>
  
  <pre><code>&lt;Connector port="8484" protocol="HTTP/1.1" SSLEnabled="true"
             maxThreads="150" scheme="https" secure="true"
             keystoreFile="/path/mykeystore"  
             keystorePass="password"
             clientAuth="false" 
             sslProtocol="TLS"
             sslEnabledProtocols="TLS" /&gt;
  </code></pre>