Notable Jetty 9.3.7 Change

[Marvin Addison]

I discovered much to my surprise that Jetty 9.3.7 disables RSA+SHA1 ciphers
in SSL connectors by default:

https://github.com/eclipse/jetty.project/commit/0a1b0b2bc69ea7e7f5f44992f47a84f926cdeebb

In our configuration, where we exclusively set includeCipherSuites as a
whitelist, I could not negotiate anything less than a TLS 1.2 connection
upon upgrading to 9.3.7. I had to explicitly override the defaults via
excludeCipherSuites to get TLS 1.0/1.1 connections to work, which is a must
for our environment and presumably most IdP deployments. I believe that the
configuration cited on
https://wiki.shibboleth.net/confluence/display/IDP30/Jetty93 will prevent
the failure we experienced since excludeCipherSuites is specified.

I attempted to discuss this change with them on their user list, but it was
pretty fruitless:

http://dev.eclipse.org/mhonarc/lists/jetty-users/msg06782.html

Bottom line: the Jetty project appears to favor security over
interoperability and deployers should explicitly configure both
include/excludeProtocols and include/excludeCipherSuites in
jetty-ssl-context.xml to ensure a stable configuration under upgrades.

M
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20160317/473006ac/attachment.html>