I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4.
(An upgrade for Java 6 is on the cards, but not before go-live date.)
We have pentest fails for a weak TLS configuration, so I want to find the best ciphersuite that both Java 6 and Apache will support, without any modifications e.g. no adding of crypto providers to Java.
I've looked at the
Client Hello coming from the Java app, and having removed the suites I know I will get failed for (export grade, RC4, etc), this is what I'm left with:
Bear in mind I only have one client to support for this, so one ciphersuite that both sides support will suffice.
I realise there may not be a clear cut answer to this, so any advice is appreciated.