I'm trying to narrow down the allowed SSL ciphers for a java application. In the java.security file, I am using:
jdk.tls.disabledAlgorithms=SSLv2Hello, SSLv3, TLSv1, TLSv1.1, 3DES_EDE_CBC, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256
Which produces the following allowed ciphers:
Will-Adams-MacBook-Air:~ Looker$ nmap -script ssl-enum-ciphers -p 9999 <AWS INSTANCE>.compute.amazonaws.com
Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-06 14:23 PDT
Nmap scan report for <AWS INSTANCE>.compute.amazonaws.com
Host is up (0.079s latency).
PORT STATE SERVICE
9999/tcp open abyss
| ssl-enum-ciphers:
| TLSv1.2:
| ciphers:
| TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A
| TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
| TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
| TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
| compressors:
| NULL
| cipher preference: client
| warnings:
| Weak certificate signature: SHA1
|_ least strength: A
Nmap done: 1 IP address (1 host up) scanned in 3.39 seconds
Great! I'm almost there. I want to also disallow TLS_RSA_WITH_AES_128_CBC_SHA
but adding it to the jdk.tls.disabledAlgorithms
disables everything:
Will-Adams-MacBook-Air:~ Looker$ nmap -script ssl-enum-ciphers -p 9999 <AWS INSTANCE>.compute.amazonaws.com
Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-06 14:28 PDT
Nmap scan report for <AWS INSTANCE>.compute.amazonaws.com
Host is up (0.079s latency).
PORT STATE SERVICE
9999/tcp open abyss
Nmap done: 1 IP address (1 host up) scanned in 0.85 seconds
Why is this? Is there a way for me to disable TLS_RSA_WITH_AES_128_CBC_SHA
without also disabling TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
, and TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
?