3

I have a custom Java application server running. I am seeing that there are some weak cipher suites supported by the server, for example some 112-bit ciphers. I want to disable those. Where can I do that? Also, I want to enable TLSv1.2. The following is the code to initialize the socket:

    KeyStore ks = KeyStore.getInstance("JKS");
    ks.load(new FileInputStream(sslstore), sslstorepass.toCharArray());
    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
    kmf.init(ks, sslcertpass.toCharArray());

    SSLContext sc = SSLContext.getInstance("TLS");
    sc.init(kmf.getKeyManagers(), null, new SecureRandom());
    SSLServerSocketFactory ssf = sc.getServerSocketFactory();
    serverSocket = ssf.createServerSocket(port);

    System.out.println("Socket initialized");
3

JAVA allows cipher suites to be removed/excluded from use in the security policy file called java.security that’s located in your JRE: $PATH/[JRE]/lib/security The jdk.tls.disabledAlgorithms property in the policy file controls TLS cipher selection. The jdk.certpath.disabledAlgorithms controls the algorithms you will come across in SSL certificates. Oracle has more information about this here.

In the security policy file, if you entered the following: jdk.tls.disabledAlgorithms=MD5, SHA1, DSA, RSA keySize < 4096 It would make it, so that MD5, SHA1, DSA are never allowed, and RSA is allowed only if the key is at least 4096 bits. As for forcing TLS versions, this depends on your operating system (Linux, Solaris, Windows, BSD, etc), server (Apache, IIS, other)

  • 1
    Thanks it helped. Also I figured out how to solve the tls version issue also. Just have to put SSLContext sc = SSLContext.getInstance("TLSv1.2"); It will support all the versions. – jgm Apr 13 '16 at 15:10
  • 1
    Small note here, as 3DES is now weak as well you should also add "DESede" to the list above. – BastianW Jun 13 '17 at 8:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.