[java-identity-provider COMMIT] /trunk/idp-distribution/src/main/resources/jetty-base/etc/jetty.xml

[noreply at shibboleth.net]

Author: scantor
Date: Mon Oct 13 00:18:14 2014
New Revision: 6679

URL: http://svn.shibboleth.net/view/java-identity-provider?rev=6679&view=rev
Log:
Updated SSL cipher whitelist, gives an A- at ssllabs.

Modified:
    trunk/idp-distribution/src/main/resources/jetty-base/etc/jetty.xml

Modified: trunk/idp-distribution/src/main/resources/jetty-base/etc/jetty.xml
URL: http://svn.shibboleth.net/view/java-identity-provider/trunk/idp-distribution/src/main/resources/jetty-base/etc/jetty.xml?rev=6679&r1=6678&r2=6679&view=diff
==============================================================================
--- trunk/idp-distribution/src/main/resources/jetty-base/etc/jetty.xml (original)
+++ trunk/idp-distribution/src/main/resources/jetty-base/etc/jetty.xml Mon Oct 13 00:18:14 2014
@@ -142,15 +142,37 @@
       <Set name="EndpointIdentificationAlgorithm"></Set>
       <Set name="NeedClientAuth"><Property name="jetty.ssl.needClientAuth" default="false"/></Set>
       <Set name="WantClientAuth"><Property name="jetty.ssl.wantClientAuth" default="false"/></Set>
-      <Set name="ExcludeCipherSuites">
+      <Set name="IncludeCipherSuites">
         <Array type="String">
-          <Item>SSL_RSA_WITH_DES_CBC_SHA</Item>
-          <Item>SSL_DHE_RSA_WITH_DES_CBC_SHA</Item>
-          <Item>SSL_DHE_DSS_WITH_DES_CBC_SHA</Item>
-          <Item>SSL_RSA_EXPORT_WITH_RC4_40_MD5</Item>
-          <Item>SSL_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
-          <Item>SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
-          <Item>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384</Item>
+
+          <Item>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</Item>
+
+          <Item>TLS_RSA_WITH_AES_128_GCM_SHA256</Item>
+          <Item>TLS_RSA_WITH_AES_256_GCM_SHA256</Item>
+
+          <Item>TLS_ECDHE_ECDSA_WITH_RC4_128_SHA</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA</Item>
+
+          <Item>TLS_ECDHE_RSA_WITH_RC4_128_SHA</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</Item>
+          <Item>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
+
+          <Item>SSL_RSA_WITH_RC4_128_SHA</Item>
+          <Item>TLS_RSA_WITH_AES_128_CBC_SHA256</Item>
+          <Item>TLS_RSA_WITH_AES_256_CBC_SHA384</Item>
+          <Item>TLS_RSA_WITH_AES_128_CBC_SHA</Item>
+          <Item>TLS_RSA_WITH_AES_256_CBC_SHA</Item>
+          <Item>SSL_RSA_WITH_3DES_EDE_CBC_SHA</Item>
         </Array>
       </Set>
     </New>
@@ -163,15 +185,37 @@
       <Set name="KeyStoreType"><Property name="jetty.backchannel.keystore.type" /></Set>
       <Set name="KeyStorePassword"><Property name="jetty.backchannel.keystore.password" /></Set>
       <Set name="EndpointIdentificationAlgorithm"></Set>
-      <Set name="ExcludeCipherSuites">
+      <Set name="IncludeCipherSuites">
         <Array type="String">
-          <Item>SSL_RSA_WITH_DES_CBC_SHA</Item>
-          <Item>SSL_DHE_RSA_WITH_DES_CBC_SHA</Item>
-          <Item>SSL_DHE_DSS_WITH_DES_CBC_SHA</Item>
-          <Item>SSL_RSA_EXPORT_WITH_RC4_40_MD5</Item>
-          <Item>SSL_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
-          <Item>SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>
-          <Item>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384</Item>
+
+          <Item>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</Item>
+
+          <Item>TLS_RSA_WITH_AES_128_GCM_SHA256</Item>
+          <Item>TLS_RSA_WITH_AES_256_GCM_SHA256</Item>
+
+          <Item>TLS_ECDHE_ECDSA_WITH_RC4_128_SHA</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA</Item>
+          <Item>TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA</Item>
+
+          <Item>TLS_ECDHE_RSA_WITH_RC4_128_SHA</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</Item>
+          <Item>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA</Item>
+          <Item>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</Item>
+
+          <Item>SSL_RSA_WITH_RC4_128_SHA</Item>
+          <Item>TLS_RSA_WITH_AES_128_CBC_SHA256</Item>
+          <Item>TLS_RSA_WITH_AES_256_CBC_SHA384</Item>
+          <Item>TLS_RSA_WITH_AES_128_CBC_SHA</Item>

[... 6 lines stripped ...]