Disabling TLS 1.1 with Jetty 9.4

[Cantor, Scott]

It happened to be on my TODO list for this week to cleanup the way I was addressing the Java policy file changes, so I have it handy.

The overridden value from java.security that would leave TLS 1.1 enabled is something like:

jdk.tls.disabledAlgorithms=SSLv3, RC4, DES, MD5withRSA, \
    DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
    include jdk.disabled.namedCurves

Compare that to the one in the /etc/alternatives/jre/conf/security/java.security file by default. You will see it pretty clearly.

The top of the file includes a comment explaining how to override portions of the file without having to copy all of it.

That's not to say there aren't other changes you may want in Jetty or that that's all you'd ever have to do, but you can't just accidentally leave TLS 1.1 on, it simply won't work. If you think it's on, then you are not talking to the web server you think you are or you're not using the JVM you think you are.

-- Scott