4.3. SSL/TLS Protocol Version
Overview
The versions of the SSL/TLS protocol that are supported by Apache CXF depend on the particular JSSE provider configured. By default, the JSSE provider is configured to be SUN’s JSSE provider implementation.
Warning
If you are using SSL/TLS security, you must ensure that you have applied the latest security patches for JBoss Fuse, in order to disable the SSLv3 protocol (see Poodle vulnerability (CVE-2014-3566)). For more details, see Disabling SSLv3 in JBoss Fuse 6.x and JBoss A-MQ 6.x.
SSL/TLS protocol versions supported by SunJSSE
Table 4.2, “SSL/TLS Protocols Supported by SUN’s JSSE Provider” shows the SSL/TLS protocol versions supported by SUN’s JSSE provider.
| Protocol | Description |
|---|---|
SSLv2Hello
|
Do not use! (POODLE security vulnerability)
|
SSLv3
|
Do not use! (POODLE security vulnerability)
|
TLSv1
|
Supports TLS version 1
|
TLSv1.1 | Supports TLS version 1.1 (JDK 7 or later) |
TLSv1.2 | Supports TLS version 1.2 (JDK 7 or later) |
Excluding specific SSL/TLS protocol versions
Because of the Poodle vulnerability (CVE-2014-3566), it is important to exclude the
SSLv3 protocol (and earlier protocols). The capability to exclude unwanted SSL/TLS protocols from your Apache CXF endpoints depends on the JBoss Fuse 6.2.0 patch level, as follows:
- No patch
- No capability to exclude vulnerable protocols from CXF endpoints (the
secureSocketProtocolattribute is available, but is not effective at restricting the available protocols). - Rollup 1 Patch 2 (R1P2)
SSLv3and earlier protocols automatically excluded (hard-coded in the runtime).- Rollup 2 Patch 1 (R2P1)
SSLv3and earlier protocols automatically excluded (hard-coded in the runtime), andsec:excludeProtocolselement supported.
Client side SSL/TLS protocol version
(Available only with Rollup 2 Patch 1) To exclude all protocols except for TLS version 1.2 on the client side, configure the
sec:excludeProtocols element as follows (assuming you are using JDK 7 or later):
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
...
<http:conduit name="{Namespace}PortName.http-conduit">
...
<http:tlsClientParameters>
...
<sec:excludeProtocols>
<sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
<sec:excludeProtocol>SSLv3</sec:excludeProtocol>
<sec:excludeProtocol>TLSv1</sec:excludeProtocol>
<sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
</sec:excludeProtocols>
</http:tlsClientParameters>
</http:conduit>
...
</beans>Important
It is recommended that you always exclude the
SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).
Server side SSL/TLS protocol version
(Available only with Rollup 2 Patch 1) To exclude all protocols except for TLS version 1.2 on the server side, configure the
sec:excludeProtocols element as follows (assuming you are using JDK 7 or later):
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
...
<httpj:engine-factory bus="cxf">
<httpj:engine port="9001">
...
<httpj:tlsServerParameters>
...
<sec:excludeProtocols>
<sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
<sec:excludeProtocol>SSLv3</sec:excludeProtocol>
<sec:excludeProtocol>TLSv1</sec:excludeProtocol>
<sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
</sec:excludeProtocols>
</httpj:tlsClientParameters>
</httpj:engine>
</httpj:engine-factory>
...
</beans>Important
It is recommended that you always exclude the
SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).
secureSocketProtocol attribute
Both the
http:tlsClientParameters element and the httpj:tlsServerParameters element support the secureSocketProtocol attribute, which enables you to specify a particular protocol.
The semantics of this attribute are confusing, however: this attribute forces CXF to pick an SSL provider that supports the specified protocol, but it does not restrict the provider to use only the specified protocol. Hence, the endpoint could end up using a protocol that is different from the one specified. For this reason, we recommend that you do not use the
secureSocketProtocol attribute in your code.
