gemini-hlsw/ocs — pull request #53 by tpolecat (2014-10-24 19:40:15+00:00)
Title: Disable SSLv3 in OCS

This change replaces the `pax-web-jetty-bundle` library bundle with one that I hacked up to disable SSLv3, which is the source of the POODLE vulnerability. The change is on a branch from the `web-1.1.3` tag as shown [here](https://github.com/gemini-hlsw/org.ops4j.pax.web/commit/c268e7df631d9ae50f288ce25aedfc6664a1c894). I simply did `mvn package` locally and copied the binary over to OCS.

Prior to the update it is possible to connect with SSLv3:

```
$ openssl s_client -connect "127.0.0.1:8443" -ssl3
CONNECTED(00000003)
depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Gemini Observatory/OU=Gemini HLDG/CN=gemini.edu
verify error:num=18:self signed certificate
verify return:1
depth=0 /C=Unknown/ST=Unknown/L=Unknown/O=Gemini Observatory/OU=Gemini HLDG/CN=gemini.edu
verify return:1
---
Certificate chain
0 s:/C=Unknown/ST=Unknown/L=Unknown/O=Gemini Observatory/OU=Gemini HLDG/CN=gemini.edu
i:/C=Unknown/ST=Unknown/L=Unknown/O=Gemini Observatory/OU=Gemini HLDG/CN=gemini.edu
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICczCCAdygAwIBAgIEUcMOIDANBgkqhkiG9w0BAQUFADB+MRAwDgYDVQQGEwdV
bmtub3duMRAwDgYDVQQIEwdVbmtub3duMRAwDgYDVQQHEwdVbmtub3duMRswGQYD
VQQKExJHZW1pbmkgT2JzZXJ2YXRvcnkxFDASBgNVBAsTC0dlbWluaSBITERHMRMw
EQYDVQQDEwpnZW1pbmkuZWR1MB4XDTEzMDYyMDE0MTM1MloXDTQwMTEwNTE0MTM1
...
```

After this update the SSLv3 connection fails, as desired:

```
$ openssl s_client -connect "127.0.0.1:8443" -ssl3
CONNECTED(00000003)
50481:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:/SourceCache/OpenSSL098/OpenSSL098-52/src/ssl/s3_pkt.c:290:
```

The OT connects fine with TLS; all clients should be fine unless specifically asking for SSLv3.