I have a Jetty based secure http service, and I wish to support GCM cipher suites. I know that Jetty internally use JSSE based ciphers, and there are many GCM ciphers coming with JSSE as documented here - http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html#ciphersuites

However, I can't get Jetty to support any of these. For eg: I configure the below ones for Jetty


but are not listed as supported ciphers from an SSL scan.

I searched a lot, and also cannot figure out where to look for available JSSE ciphers in a distribution. Any help would be appreciated.

1 Answer 1


The document you are linking to lists only the standard cipher suite names; it does not promise that all these cipher suites are actually supported by any JSSE provider, in particular the one which comes with Java and is called SunJSSE. That the standard name TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 is defined just means that if a JSSE provider wants to provide support for that cipher suite, then it must provide it under that name.

This document, which allegedly pertains to Java 7 as well, lists the cipher suites which SunJSSE actually supports; some enabled by default, others disabled by default. I see no GCM cipher suite at all...

Support for GCM cipher suites may be added in a future version; you might want to try some previews of Java 8 (Java 8 release is due March 2014). In any case, GCM cipher suites in SSL require TLS 1.2 (they don't work with previous protocol versions), and the AES_256 is 256-bit AES which, with the cryptographic implementations provided with Java, requires the JCE Unlimited Strength Jurisdiction Policy Files (a remnant of the US export regulations on cryptographic material).

  • Thanks! TLS 1.2 is already supported in my case, and have patched the jdk distribution with JCE unlimited policy files. I tried with JDK8 as well, but it doesn't provide GCM cipher suites. Perhaps I should experiment with some JCE providers. I had a quick test with Bouncy Castle library, but looks like it doesn't offer any GCM suites either. :(
    – Alavalathi
    Sep 11, 2013 at 16:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .