Java crypto roadmap

[Ian Young]

> On 2019-10-16, at 15:37, Cantor, Scott <cantor.2 at osu.edu> wrote:
> 
> On 10/16/19, 10:34 AM, "dev on behalf of Ian Young" <dev-bounces at shibboleth.net on behalf of ian at iay.org.uk> wrote:
> 
>> * TLS 1.0 and TLS 1.1 being *disabled* in all versions of Java from Java 7 onwards, second half of 2020. This is new and
>> will presumably affect existing deployments if they take the relevant Java update (which I have to assume a lot of people
>> will).
> 
> As in "removed" or just a default policy rule that can be overridden to turn them back on?

They say disabled rather than removed, so I guess there might be a way to turn it back on. Might require editing java.security though (that's how they suggest testing disabling them).

> I broke a bunch of Red Hat <mumble> systems by turning off TLS 1.1 on my Jetty servers where I host my metadata locally so this would be a big deal if not revocable.

Ugh. When did RHEL add support for 1.2? RHEL 6 or was it 7?

I got this via a tweet by Sean Mullan, might be worth asking him directly.

    -- Ian




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20191016/b1bb691a/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20191016/b1bb691a/attachment-0001.p7s>