TLS 1.1-1.2 support (better, secure protocols)

[wwwpixime]

hi David,

This feature request may not be on demand, but I'll just propose this hoping it will be reconsidered in the future versions.

I've setup 5 public WebDAV targets for developer testing (Login: webdav/webdav)

• ​https://dav.pixi.me/ (no SSLv3, supports TLSv1-1.2 - Apache/mod_dav framework)
• ​https://tlsv11.pixi.me/ (no SSLv3, supports TLSv1.1 only -Apache/mod_dav framework)
• ​https://tlsv12.pixi.me/ (no SSLv3, supports TLSv1.2 only - Apache/mod_dav framework)
• ​http://dav.negimaki.com/ (no SSL/TLS required - Apache/mod_dav framework)

• ​https://g2.pixi.me/w/webdav/ (no SSLv3, supports TLSv1-1.2 - Gallery 2 WebDAV module framework) - uploads will render 0 bytes because Cyberduck only supports certain types of WebDAV frameworks, mainly Apache/mod_dav

ciphers we use (in Server preferred order):

• ECDHE-RSA-AES256-GCM-SHA384
• ECDHE-RSA-AES128-GCM-SHA256
• ECDHE-RSA-RC4-SHA
• ECDHE-RSA-AES256-SHA384
• ECDHE-RSA-AES128-SHA256
• ECDHE-RSA-AES128-SHA
• RC4-SHA

Per target, my testing involves these actions:

• upload/rename/delete files of various types (image, docs, pdfs)
• upload/rename/delete/move folders

I'll update the entry for Cyberduck (both platforms) in ​https://pixi.me/webdav.php#matrix whenever these enhancement request will get implemented in the future.

Thanks again!

Best regards,

Steve Caturan

[dkocher]

​SunJSSE Provider

1Although SunJSSE in the Java SE 7 release supports TLS 1.1 and TLS 1.2, neither version is enabled by default for client connections. Some servers do not implement forward compatibility correctly and refuse to talk to TLS 1.1 or TLS 1.2 clients. For interoperability, SunJSSE does not enable TLS 1.1 or TLS 1.2 by default for client connections

[dkocher]

Fix use of custom SSL socket configuration in r14101.

[dkocher]

In r14103.

[dkocher]

Please test with the latest snapshot build available.

[dkocher]

We have tests added in r14103 but do not assert the protocol versions.

[wwwpixime]

Thank you for implementing this enhancement, I didn't expect it this quick. I can confirm that Cyberduck 4.4.x build 14107 supports TLSv1.2, TLSv1.1 and TLSv1.0 on Apache 2.4.6/mod_ssl OpenSSL/1.0.1e

[dkocher]

Replying to wwwpixime:

Thank you for implementing this enhancement, I didn't expect it this quick. I can confirm that Cyberduck 4.4.x build 14107 supports TLSv1.2, TLSv1.1 and TLSv1.0 on Apache 2.4.6/mod_ssl OpenSSL/1.0.1e

Thanks for your testing and interoperability matrix!

[dkocher]

TLSv1.2 is currently known not work (handshake failure) in the Windows version.

[dkocher]

Replying to dkocher:

TLSv1.2 is currently known not work (handshake failure) in the Windows version.

Caused by missing ECDHE ciphers.

[yla]

In r14216. A new ​snapshot build is available.

[dkocher]

#7760 closed as duplicate.