I have a legacy application which sits on Java 6(!), and talks to Apache 2.2.15 on RHEL 6.4.
(An upgrade for Java 6 is on the cards, but not before go-live date.)
We have pentest fails for a weak TLS configuration, so I want to find the best ciphersuite that both Java 6 and Apache will support, without any modifications e.g. no adding of crypto providers to Java.
I've looked at the
Client Hello coming from the Java app, and having removed the suites I know I will get failed for (export grade, RC4, etc), this is what I'm left with:
TLS_RSA_WITH_AES_128_CBC_SHA TLS_RSA_WITH_AES_256_CBC_SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA TLS_DHE_DSS_WITH_AES_128_CBC_SHA TLS_DHE_DSS_WITH_AES_256_CBC_SHA TLS_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
Bear in mind I only have one client to support for this, so one ciphersuite that both sides support will suffice.
I realise there may not be a clear cut answer to this, so any advice is appreciated.