SSL Exception in Tomcat with CAS

Issue

While running Tomcat with CAS authentication, the following error occurs:

javax.net.ssl.SSLException: Received fatal alert: protocol_version

Cause

This error indicates that the server does not support the TLS version being used by the client. It is likely that an older TLS version is being used, causing the connection to fail.

Solution

To explicitly enforce TLS 1.2, update the JAVA_OPTS environment variable as follows:

export JAVA_OPTS="$JAVA_OPTS -Dhttps.protocols=TLSv1.2 -Djdk.tls.client.protocols=TLSv1.2"

Additional Steps Verify the Java version using:

java -version

Ensure it supports TLS 1.2.

Check if your application is running an older Java version that does not support modern TLS versions. If so, consider upgrading.

Restart Tomcat after applying the changes:

shutdown.sh
startup.sh

2025-02-13 11:53:07,370 ERROR [org.jasig.cas.util.HttpClient] - <javax.net.ssl.SSLException: Received fatal alert: protocol_version>
javax.net.ssl.SSLException: Received fatal alert: protocol_version
	at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
	at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
	at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1959)
	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1077)
	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
	at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
	at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
	at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1091)
	at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
	at org.jasig.cas.util.HttpClient.sendMessageToEndPoint(HttpClient.java:70)
	at org.jasig.cas.authentication.principal.AbstractWebApplicationService.logOutOfService(AbstractWebApplicationService.java:147)
	at org.jasig.cas.ticket.TicketGrantingTicketImpl.logOutOfServices(TicketGrantingTicketImpl.java:115)
	at org.jasig.cas.ticket.TicketGrantingTicketImpl.expire(TicketGrantingTicketImpl.java:125)
	at org.jasig.cas.CentralAuthenticationServiceImpl.destroyTicketGrantingTicket(CentralAuthenticationServiceImpl.java:153)
	at org.jasig.cas.web.LogoutController.handleRequestInternal(LogoutController.java:63)
	at org.springframework.web.servlet.mvc.AbstractController.handleRequest(AbstractController.java:153)
	at org.springframework.web.servlet.mvc.SimpleControllerHandlerAdapter.handle(SimpleControllerHandlerAdapter.java:48)
	at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:875)
	at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:809)
	at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:523)
	at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:453)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:617)
	at javax.servlet.http.HttpServlet.service(HttpServlet.java:723)
	at org.jasig.cas.web.init.SafeDispatcherServlet.service(SafeDispatcherServlet.java:115)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
	at org.inspektr.common.web.ClientInfoThreadLocalFilter.doFilterInternal(ClientInfoThreadLocalFilter.java:48)
	at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:76)
	at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
	at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
	at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:233)
	at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
	at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
	at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
	at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
	at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:293)
	at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:861)
	at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:606)
	at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:489)
	at java.lang.Thread.run(Thread.java:744)
2025-02-13 11:53:16,726 INFO [org.jasig.cas.authentication.AuthenticationManagerImpl] - <AuthenticationHandler: org.jasig.cas.adaptors.jdbc.QueryDatabaseAuthenticationHandler successfully authenticated the user which provided the following credentials: [username: admin]>
2025-02-13 11:53:16,726 INFO [org.jasig.cas.CentralAuthenticationServiceImpl] - <Granted service ticket [ST-2-KLy6snBeqYeu4eGFDRcr-cas] for service [https://dialoglbsn.hsenidmobile.com/lbs-admin/j_spring_cas_security_check] for user [admin]>
2025-02-13 11:53:17,232 INFO [org.jasig.cas.CentralAuthenticationServiceImpl] - <Granted service ticket [ST-3-LXs0JZaA7NwZfmWJUeDo-cas] for service [https://dialoglbsn.hsenidmobile.com/lbs-admin/j_spring_cas_security_check] for user [admin]>
2025-02-13 11:53:34,588 INFO [org.jasig.cas.CentralAuthenticationServiceImpl] - <Granted service ticket [ST-4-0QPS6PyeRg9JRPS

• Next Steps

1. If the issue persists, check the TLS settings in your CAS server configuration.
2. Ensure Tomcat's server.xml is configured to support TLS 1.2.
3. Investigate Java security policies that might be restricting the allowed protocols.

Written by A.M. Rinas