I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4.

(An upgrade for Java 6 is on the cards, but not before go-live date.)

We have pentest fails for a weak TLS configuration, so I want to find the best ciphersuite that both Java 6 and Apache will support, without any modifications e.g. no adding of crypto providers to Java.

I've looked at the Client Hello coming from the Java app, and having removed the suites I know I will get failed for (export grade, RC4, etc), this is what I'm left with:


Bear in mind I only have one client to support for this, so one ciphersuite that both sides support will suffice.

I realise there may not be a clear cut answer to this, so any advice is appreciated.

  • Bear in mind that all the 3DES ones have been shown to offer 58 bit equivalent strength, despite nominally being higher - depending on your pentest provider, this might be highlighted as offering lower protection than you wanted.
    – Matthew
    Nov 20, 2015 at 11:15
  • I thought 3DES might be out, just included because I wasn't sure. Nov 20, 2015 at 11:18
  • I found a tool here nartac.com/Products/IISCrypto/Download that lists the preferred order of ciphersuites, and the first one in that that both can support is TLS_RSA_WITH_AES_256_CBC_SHA, or AES256-SHA in apache-speak. One of the pentest recommednations is to avoid CBC mode, but I can't with what I have available at the moment. So is this the best of a bad bunch? Nov 20, 2015 at 11:21
  • Although the Java client hello list lists the AES128 version above that, (and incidentally two RC4 ciphersuites above that). So why does it consider AES128 better than AES256? Nov 20, 2015 at 11:23
  • 2
    @Matthew 3DES is not 58-bit, it's 112-bit. That said some Pentest providers still mark it as "insecure" for being less that 128-bit, so best avoided. (the fact that no-one has ever actually cracked a 112-bit key is apparently neither here nor there. Nov 20, 2015 at 12:01

1 Answer 1


I tend to go off the list that Mozilla provides, which gets updated every so often, although no where near as frequently as browsers do!

This currently suggests the following cipher order for a "modern" browser:


This would suggest that the best option you have is DHE-RSA-AES128-SHA (which I am fairly sure is Apache speak for TLS_DHE_RSA_WITH_AES_128_CBC_SHA).

Not sure why the AES128 one would be preferred over AES256, but it is the same in the Mozilla list.


Original version stated "DHE-RSA-AES128-SHA256", which was wrong - fingers used to typing SHA256...


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .