4

Currently I am using this code which is enabling TLS 1.2:

ServerConnector httpsConnector = new ServerConnector(server, 
       new SslConnectionFactory(sslContextFactory, "http/1.1"),
       new HttpConnectionFactory(https_config));
httpsConnector.setPort(8443);
httpsConnector.setIdleTimeout(50000)

Now I am using TLS 1.1 and want to change it to TLS 1.2.

dur
  • 15,689
  • 25
  • 79
  • 125
billabong
  • 41
  • 1
  • 1
  • 2
  • What version of Jetty? What version of Java? how are you checking for TLS level? What have you tried? – Joakim Erdfelt Apr 11 '17 at 16:25
  • Hi , Jetty version is 9. I am not sure about how are you checking TLS level ? can you please elaborate and I am aiming to change the Rest service call URL from HTTP to HTTPS. – billabong Apr 17 '17 at 20:49
  • Jetty 9 is insufficiently detailed. Jetty 9.x covers currently 5 major versions of Jetty. (Jetty versioning is ..) - we need to know the Java version as well. – Joakim Erdfelt Apr 17 '17 at 21:31
  • Its Jetty 9.2.21.v20170120 and java is java 8 – billabong Apr 17 '17 at 22:15

2 Answers2

4

Java 8 is TLS/1.2 by default.

You can diagnose TLS in the JVM using the techniques at:

If you want to force TLS/1.2, see the prior answer at:

How to force java server to accept only tls 1.2 and reject tls 1.0 and tls 1.1 connections

Know that the ciphers and protocols you expose in Jetty's SslContextFactory will also have an influence on your TLS support level. (For example: you can exclude the ciphers that TLS/1.0 knows about leaving no ciphers to negotiate against)

Community
  • 1
  • 1
Joakim Erdfelt
  • 46,896
  • 7
  • 86
  • 136
0

Yeah, I resolved this question just now.
We can customize it by org.eclipse.jetty.util.ssl.SslContextFactory just like this:

  1. exclude TLSv1、TLSv1.1 protocol etc.
sslContextFactory.addExcludeProtocols("TLSv1", "TLSv1.1");

By the way, my jetty version is 9.4.45, default protocols("SSL", "SSLv2", "SSLv2Hello", "SSLv3") have already excluded by Jetty.

// org.eclipse.jetty.util.ssl.SslContextFactory#DEFAULT_EXCLUDED_PROTOCOLS
private static final String[] DEFAULT_EXCLUDED_PROTOCOLS = {"SSL", "SSLv2", "SSLv2Hello", "SSLv3"};
  1. include only TLSv1.2 protocol (some protocols etc.)
    sslContextFactory.setIncludeProtocols("TLSv1.2");

The final protocols selected you can see in the method org.eclipse.jetty.util.ssl.SslContextFactory#selectProtocols , you can debug yourself.

Mr. Liu
  • 1
  • 1