diff --git a/client/conf/java.security.ciphers.in b/client/conf/java.security.ciphers.in index 986abf61e71..27e2d690ee6 100644 --- a/client/conf/java.security.ciphers.in +++ b/client/conf/java.security.ciphers.in @@ -15,4 +15,4 @@ # specific language governing permissions and limitations # under the License. -jdk.tls.disabledAlgorithms=DH keySize < 128, RSA keySize < 128, DES keySize < 128, SHA1 keySize < 128, MD5 keySize < 128, RC4 \ No newline at end of file +jdk.tls.disabledAlgorithms=SSLv2Hello, SSLv3, TLSv1, TLSv1.1, DH keySize < 128, RSA keySize < 128, DES keySize < 128, SHA1 keySize < 128, MD5 keySize < 128, RC4 diff --git a/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java b/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java index 9fbdb4aa553..8016f5a1916 100644 --- a/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java +++ b/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java @@ -34,7 +34,7 @@ public class SSLUtils { public static String[] getSupportedProtocols(String[] protocols) { Set set = new HashSet(); for (String s : protocols) { - if (s.equals("TLSv1") || s.equals("TLSv1.1") || s.equals("SSLv3") || s.equals("SSLv2Hello")) { + if (s.equals("SSLv3") || s.equals("SSLv2Hello")) { continue; } set.add(s); @@ -46,7 +46,7 @@ public class SSLUtils { * It returns recommended protocols that are considered secure. */ public static String[] getRecommendedProtocols() { - return new String[] { "TLSv1.2" }; + return new String[] { "TLSv1", "TLSv1.1", "TLSv1.2" }; } /** diff --git a/utils/src/test/java/com/cloud/utils/security/SSLUtilsTest.java b/utils/src/test/java/com/cloud/utils/security/SSLUtilsTest.java index 6c66dcd1bd0..625b538d7f2 100644 --- a/utils/src/test/java/com/cloud/utils/security/SSLUtilsTest.java +++ b/utils/src/test/java/com/cloud/utils/security/SSLUtilsTest.java @@ -69,9 +69,9 @@ public class SSLUtilsTest { } private void verifyProtocols(ArrayList protocolsList) { + Assert.assertTrue(protocolsList.contains("TLSv1")); + Assert.assertTrue(protocolsList.contains("TLSv1.1")); Assert.assertTrue(protocolsList.contains("TLSv1.2")); - Assert.assertFalse(protocolsList.contains("TLSv1")); - Assert.assertFalse(protocolsList.contains("TLSv1.1")); Assert.assertFalse(protocolsList.contains("SSLv3")); Assert.assertFalse(protocolsList.contains("SSLv2Hello")); }