Question

I am using SWFUpload to upload files to a web server, which is running Tomcat. Users have started to receive errors from the server after their uploads complete. The logs indicate that the files have no content on the server, and SWFUpload running in debug mode doesn’t seem to think there’s an issue sending the file.

The issue only manifests when all of the following are true:

• Client uses SSL
• Client is on Windows 7
• Client uses Flash uploader. HTML uploads work just fine.
• Client uses IE

Answer 1

At first, I suspected this to be related to an issue with IE and setting the Pragma and Cache-Control headers to prevent client-side caching of my SWF file, which is well-documented here. I was confused though, because I only observed the issue when uploading. Downloads were unaffected.

In the end, the issue appears to have had its genesis in a security update for Internet Explorer that was released in January, 2012, intended to address a vulnerability that could allow someone to decrypt SSL 3.0/TLS 1.0 encrypted traffic.

Microsoft’s workaround is to ensure the server supports TLS 1.1, and enable support for TLS 1.1 in IE. Disabling TLS 1.0 causes IE to fall back to SSL 3.0, and appears to resolve the issue as well, but is not ideal.

Java only supports TLS 1.1 as of JRE 1.7. Tomcat uses the JSSE libraries for SSL. Unless you’re using native Tomcat libraries, which may already support TLS 1.1, make sure you upgrade to JRE 1.7 and Tomcat 7 in order to get TLS 1.1.

One final note to those of you fronting with Apache and OpenSSL: It appears that OpenSSL 0.9.x only supports TLS 1.0. I hear you can build Apache with GnuTLS instead, which should give you TLS 1.1+.

Additional reference: http://www.thehijax.com/?p=72