<div>
Dayne,</div><div><br></div><div>Thank you very much for the detailed explanation. I've just re-enabled TLS renegotiation in Netty. You will see this change in 3.2.6.</div><div><br></div><div>Cheers</div><div>-- <br><a href="http://gleamynode.net/">Trustin Lee</a><br></div>
<p style="color: #A0A0A8;">On Sunday, September 25, 2011 at 7:45 PM, DLucas wrote:</p>
<blockquote type="cite" style="border-left-style:solid;border-width:1px;margin-left:0px;padding-left:10px;">
<span><div><div>Hi Trustin,<br><br>Oracle has released a fix to TLS renegotiation flaws as per RFC 5746: <br><a href="http://www.oracle.com/technetwork/java/javase/documentation/tlsreadme2-176330.html">http://www.oracle.com/technetwork/java/javase/documentation/tlsreadme2-176330.html</a><br><a href="http://www.oracle.com/technetwork/java/javase/documentation/tlsreadme2-176330.html">http://www.oracle.com/technetwork/java/javase/documentation/tlsreadme2-176330.html</a> <br><br>According to that document, safe renegotiation is on by default: "Use of the<br>proper RFC 5746 messages is optional, however legacy (original SSL/TLS<br>specifications) renegotiations are disabled if the proper messages are not<br>used. Initial legacy connections are still allowed, but legacy<br>renegotiations are disabled. This is the best mix of security and<br>interoperability, and is the default setting."<br><br>If this is the case then enabling re-negotiation on a JVM that is Java6<br>Update 22 or higher will not be a security issue anymore.<br><br>Best regards,<br><br>Dayne<br><br>--<br>View this message in context: <a href="http://netty-forums-and-mailing-lists.685743.n2.nabble.com/Turning-on-TLS-renegotiation-tp6778465p6828889.html">http://netty-forums-and-mailing-lists.685743.n2.nabble.com/Turning-on-TLS-renegotiation-tp6778465p6828889.html</a><br>Sent from the Netty User Group mailing list archive at <a href="http://Nabble.com">Nabble.com</a>.<br>_______________________________________________<br>netty-users mailing list<br><a href="mailto:netty-users@lists.jboss.org">netty-users@lists.jboss.org</a><br><a href="https://lists.jboss.org/mailman/listinfo/netty-users">https://lists.jboss.org/mailman/listinfo/netty-users</a><br></div></div></span>
</blockquote>
<div>
<br>
</div>