title: Tomcat APR connector and POODLE
body: <p>I have a couple of production servers running Tomcat 7.0 with an APR+SSL connector and because of the recent POODLE attack I was asked to disable SSLv3 completely in some of these servers. I dig through the <a href="http://tomcat.apache.org/tomcat-7.0-doc/config/http.html#SSL_Support" rel="nofollow">Tomcat Connectors</a> documentation and according to it, setting <code>SSLProtocol</code> to <code>TLSv1</code> (instead of <code>all</code> should be sufficient to disable SSLv3 and enforce TLSv1.</p>
  
  <p>The problem is that <code>TLSv1</code> seems to enable TLS but does not make the server refuse SSLv3. I tested this using <code>openssl s_client -connect -ssl3</code> and I verified that plain-old SSLv3 connections can still be accepted, so I was wondering if this is a bug in Tomcat or if there is something else that I need to set to disabled SSLv3 completely.</p>
  
  <p><strong>UPDATE:</strong> I disabled APR for now and reverted to using a NIO connector with <code>sslProtocol="TLS"</code> and that works fine. The problem seems to be specifically affecting APR. For reference, this is my new connector configuration:</p>
  
  <pre><code>&lt;Connector port="443" 
    protocol="org.apache.coyote.http11.Http11NioProtocol" 
    SSLEnabled="true"
    maxThreads="500" 
    scheme="https" 
    secure="true"
    clientAuth="false"
    keystoreFile="/etc/keys/***.ks"
    keystorePass="****"
    sslProtocol = "TLS"
    sslEnabledProtocols="TLSv1.1,TLSv1.2"
  /&gt;
  </code></pre>