SSL - 128 bit encryption instead of 40 bit?

Question

Hi,
I setup my Tomcat 4.0.3 server to use SSL as directed in a book on servlets that I bought from sun press. Everything works fine, the server starts with SSL support and you can access it with https:, download the cert, etc. I downloaded jsse 1.0.2 jar files and put them into my /jre/lib/ext/ dir as directed and created the keystore for the key with:
keytool -genkey -alias tomcat -keyalg RSA -validity 730
also directed by the book.
My problem is that the keys generated are using 40 bit encryption instead of strong 128. I want to make the site as secure as possible and I'm wondering how to do that. I followed the directions exactly, downloaded the version of jsse for us/canada and yet my certs still say that they were encrypted with 40 bit not 128 bit encryption.
Mike

Answer 1

My problem is that the keys generated are using 40 bit
encryption instead of 128. What client do you use to connect to Tomcat?
If the client does not support 128 bit keys for RC4, the browser
and SSL 3.0 may negotiate a weaker session encryption key,
in your case 40 bit.
I don't use Tomcat, but with my web server you can configure
the SSL protocol versions it accepts, and the ciphers it accepts;
ie I can switch off everything other than RC4-128. -- Can the same
thing be done in Tomcat, and how can it be done?