I have multiple java based application that interact with each over over TLS and I am trying to enforce 128 bit ciphers for TLS communication.
The way I am enforcing 128 bit cipher on the java(server side) is by setting following property in the java.security
file of the JDK :
jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, DH keySize > 128,
EC keySize > 128,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,
TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384,
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256,
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384,
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384,
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_256_CCM,
TLS_ECDHE_ECDSA_WITH_AES_256_CCM_8, 3DES_EDE_CBC, anon, NULL
I have test java program that uses HttpsURLConnection to access a web resource deployed in the jetty container which also uses same JDK(configured to present 128 ciphers only for TLS communicaiton) and the test program works fine with successful SSL handshake(client-server hello messages exchanged successfully and server presenting TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 and client also accepting the same cipher).
But when I try to use curl to access the same web resource, the curl command fails with following error :
curl: (35) schannel: next InitializeSecurityContext failed: SEC_E_ILLEGAL_MESSAGE (0x80090326) - This error usually occurs when a fatal SSL/TLS alert is received (e.g. handshake failed).
Similar exception is seen when a network traffic is captured using wireshark.
Question : How can I enforce 128 cipher for TLS communication for java based applications?
curl
not connecting? Have you checked to see what ciphers it can use?