title: protect tomcat 6 apr SSL against BEAST attack
body: <p>We run a web application on Tomcat 6 using the native Apache Portable Runtime SSL connector to provide SSL connectivity. How can we configure the server to prevent against the BEAST attack?. The suggested solution (1) can not be configured in the Tomcat configuration, because it does not allow to set the SSLHonorCipherOrder parameter (2).</p>
  
  <p>We currently use only the setting SSLCipherSuite="ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM" but a scan using the SSL Server Test shows the server is still vulnerable against the BEAST attack. I know we can solve the issue by fronting Tomcat with an Apache proxy, but this change is too invasive to implement in the short term. I can also patch Tomcat to add support, but this would prevent automatic updates of the Tomcat package which goes against policies.</p>
  
  <p>1: <a href="https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-the-beast-attack-on-tls" rel="nofollow">https://community.qualys.com/blogs/securitylabs/2011/10/17/mitigating-the-beast-attack-on-tls</a></p>
  
  <p>2: <a href="http://tomcat.apache.org/tomcat-6.0-doc/apr.html" rel="nofollow">http://tomcat.apache.org/tomcat-6.0-doc/apr.html</a></p>