Created attachment 203125 [details]
Patch against /usr/ports

Attached is patch which makes Tomcat run with 1.2.21:

> 2019-03-25T13:10:25.675 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Server number:         8.5.38.0
> 2019-03-25T13:10:25.675 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Name:               FreeBSD
> 2019-03-25T13:10:25.675 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log OS Version:            12.0-STABLE
> 2019-03-25T13:10:25.675 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Architecture:          amd64
> 2019-03-25T13:10:25.675 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log Java Home:             /usr/local/openjdk8/jre
> 2019-03-25T13:10:25.675 INFO [main] org.apache.catalina.startup.VersionLoggerListener.log JVM Version:           1.8.0_202-b08
> 2019-03-25T13:10:25.678 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent Loaded APR based Apache Tomcat Native library [1.2.21] using APR version [1.6.5].
> 2019-03-25T13:10:25.678 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR capabilities: IPv6 [true], sendfile [true], accept filters [true], random [true].
> 2019-03-25T13:10:25.678 INFO [main] org.apache.catalina.core.AprLifecycleListener.lifecycleEvent APR/OpenSSL configuration: useAprConnector [true], useOpenSSL [true]
> 2019-03-25T13:10:25.682 INFO [main] org.apache.catalina.core.AprLifecycleListener.initializeSSL OpenSSL successfully initialized [OpenSSL 1.1.1a-freebsd  20 Nov 2018]

This makes TLS 1.3 to work out of the box:

> osipovmi@deblndw011x:~/var/Projekte/maven-surefire (master *=)
> $ curl https://sitex-ldadw.ad001.siemens.net:8445/backend-dev/docs/toolchain/ --verbose
> *   Trying 147.54.64.55...
> * TCP_NODELAY set
> * Expire in 200 ms for 4 (transfer 0x800d65000)
> * Connected to sitex-ldadw.ad001.siemens.net (147.54.64.55) port 8445 (#0)
> * ALPN, offering h2
> * ALPN, offering http/1.1
> * successfully set certificate verify locations:
> *   CAfile: /usr/local/etc/ssl/cert.pem
>   CApath: none
> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
> * TLSv1.3 (IN), TLS handshake, Server hello (2):
> * TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
> * TLSv1.3 (IN), TLS handshake, Certificate (11):
> * TLSv1.3 (IN), TLS handshake, CERT verify (15):
> * TLSv1.3 (IN), TLS handshake, Finished (20):
> * TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
> * TLSv1.3 (OUT), TLS handshake, Finished (20):
> * SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
> * ALPN, server accepted to use h2
> * Server certificate:
> *  subject: C=DE; O=Siemens; OU=LDA DW; CN=sitex-ldadw.ad001.siemens.net
> *  start date: Mar 19 13:10:13 2019 GMT
> *  expire date: Mar 19 13:10:13 2020 GMT
> *  subjectAltName: host "sitex-ldadw.ad001.siemens.net" matched cert's "sitex-ldadw.ad001.siemens.net"
> *  issuer: C=DE; ST=Bayern; L=Muenchen; O=Siemens; serialNumber=ZZZZZZB7; OU=Siemens Trust Center; CN=Siemens Issuing CA Intranet Server 2017
> *  SSL certificate verify ok.
> * Using HTTP2, server supports multi-use
> * Connection state changed (HTTP/2 confirmed)
> * Copying HTTP/2 data in stream buffer to connection buffer after upgrade: len=0
> * Using Stream ID: 1 (easy handle 0x800d65000)
> > GET /backend-dev/docs/toolchain/ HTTP/2
> > Host: sitex-ldadw.ad001.siemens.net:8445
> > User-Agent: curl/7.64.0
> > Accept: */*
> >
> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
> * TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
> * old SSL session ID is stale, removing
> * Connection state changed (MAX_CONCURRENT_STREAMS == 200)!
> < HTTP/2 401

Poudriere tests pending...