如何强制java服务器只接受tls 1.2并拒绝tls 1.0和tls 1.1连接 [英] How to force java server to accept only tls 1.2 and reject tls 1.0 and tls 1.1 connections

问题描述

我有一个在java 7上运行的https Web服务。我需要进行更改，以便此服务只接受tls1.2连接并拒绝ssl3，tls1.0和tls1.1。

I have a https web service running on java 7. I need to make changes so that this service only accepts tls1.2 connection and reject ssl3, tls1.0 and tls1.1.

我添加了以下java参数，以便tls1.2具有最高优先级。

I have added the following java parameter so that tls1.2 is highest priority.

-Dhttps.protocols=TLSv1.2

但它也接受来自java客户端的tls1.0连接。如果客户端也使用上面的java参数运行，则连接是tls1.2但是如果客户端在没有此参数的情况下运行，则连接是tls1.0。

but it also accepts the tls1.0 connections from java clients. if the client is also running with above java parameter, the connection is tls1.2 but if the client is running without this parameter, the connections is tls1.0.

I有人玩jdk / jre / lib / security文件夹中的java.security文件。

I did some play around the java.security file in jdk/jre/lib/security folder.

我目前有以下禁用算法：

i currently have following disabled algorithms:

jdk.certpath.disabledAlgorithms= MD2, MD4, MD5, SHA224, DSA, EC keySize < 256, RSA keySize < 2048, SHA1 keysize < 224
jdk.tls.disabledAlgorithms=DSA, DHE, EC keySize < 256, RSA keySize < 2048, SHA1 keysize < 224

我使用的是java 7，更新79.我不倾向于拦截每个连接并检查tls version。

I am using java 7, update 79. I am not inclined towards intercepting each connection and checking the tls version.

我的服务器证书是使用带有RSA算法的MD5生成的2048位。

My server certificate is 2048 bit generated with MD5 with RSA algorithm.

如果禁用算法list具有RSA代替RSA keySize< 2048，我收到SSLHandShakeError并显示错误消息：没有共同的密码套件。

If the disabled algorithm list has RSA in place of RSA keySize < 2048, I get the SSLHandShakeError with error message : no cipher suites in common.

我的测试程序正在运行来自以下URL的http服务器：
http://www.herongyang.com/JDK/HTTPS-HttpsEchoer-Better-HTTPS-Server.html

My test program is running the http server from following URL: http://www.herongyang.com/JDK/HTTPS-HttpsEchoer-Better-HTTPS-Server.html

请帮助如何让java只接受tls 1.2连接。

please help how to make java accept only tls 1.2 connections.

推荐答案

我找到了解决方案。我设置了

I found a solution for this. I set the

jdk.tls.disabledAlgorithms= SSLv2Hello, SSLv3, TLSv1, TLSv1.1

。

设置此项后，服务器仅接受TLS1.2连接并拒绝较低安全协议版本。

After setting this, server only accepts the TLS1.2 connection and reject lower security protocol versions.

这篇关于如何强制java服务器只接受tls 1.2并拒绝tls 1.0和tls 1.1连接的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！