4.3. SSL/TLS Protocol Version
Overview
The versions of the SSL/TLS protocol that are supported by Apache CXF depend on the particular JSSE provider configured. By default, the JSSE provider is configured to be SUN’s JSSE provider implementation.
Warning
If you enable SSL/TLS security, you must ensure that you explicitly disable the SSLv3 protocol, in order to safeguard against the Poodle vulnerability (CVE-2014-3566). For more details, see Disabling SSLv3 in JBoss Fuse 6.x and JBoss A-MQ 6.x.
SSL/TLS protocol versions supported by SunJSSE
Table 4.2, “SSL/TLS Protocols Supported by SUN’s JSSE Provider” shows the SSL/TLS protocol versions supported by SUN’s JSSE provider.
| Protocol | Description |
|---|---|
SSLv2Hello
|
Do not use! (POODLE security vulnerability)
|
SSLv3
|
Do not use! (POODLE security vulnerability)
|
TLSv1
|
Supports TLS version 1
|
TLSv1.1 | Supports TLS version 1.1 (JDK 7 or later) |
TLSv1.2 | Supports TLS version 1.2 (JDK 7 or later) |
Excluding specific SSL/TLS protocol versions
By default, all of the SSL/TLS protocols provided by the JSSE provider are available to the CXF endpoints (except for the
SSLv2Hello and SSLv3 protocols, which have been specifically excluded by the CXF runtime since JBoss Fuse version 6.2.0, because of the Poodle vulnerability (CVE-2014-3566)).
To exclude specific SSL/TLS protocols, use the
sec:excludeProtocols element in the endpoint configuration. You can configure the sec:excludeProtocols element as a child of the http:tlsClientParameters element (client side) or as a child of the httpj:tlsServerParameters element (server side).
Client side SSL/TLS protocol version
To exclude all protocols except for TLS version 1.2 on the client side, configure the
sec:excludeProtocols element as follows (assuming you are using JDK 7 or later):
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
...
<http:conduit name="{Namespace}PortName.http-conduit">
...
<http:tlsClientParameters>
...
<sec:excludeProtocols>
<sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
<sec:excludeProtocol>SSLv3</sec:excludeProtocol>
<sec:excludeProtocol>TLSv1</sec:excludeProtocol>
<sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
</sec:excludeProtocols>
</http:tlsClientParameters>
</http:conduit>
...
</beans>Important
It is recommended that you always exclude the
SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).
Server side SSL/TLS protocol version
To exclude all protocols except for TLS version 1.2 on the server side, configure the
sec:excludeProtocols element as follows (assuming you are using JDK 7 or later):
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
...
<httpj:engine-factory bus="cxf">
<httpj:engine port="9001">
...
<httpj:tlsServerParameters>
...
<sec:excludeProtocols>
<sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
<sec:excludeProtocol>SSLv3</sec:excludeProtocol>
<sec:excludeProtocol>TLSv1</sec:excludeProtocol>
<sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
</sec:excludeProtocols>
</httpj:tlsClientParameters>
</httpj:engine>
</httpj:engine-factory>
...
</beans>Important
It is recommended that you always exclude the
SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).
secureSocketProtocol attribute
Both the
http:tlsClientParameters element and the httpj:tlsServerParameters element support the secureSocketProtocol attribute, which enables you to specify a particular protocol.
The semantics of this attribute are confusing, however: this attribute forces CXF to pick an SSL provider that supports the specified protocol, but it does not restrict the provider to use only the specified protocol. Hence, the endpoint could end up using a protocol that is different from the one specified. For this reason, we recommend that you do not use the
secureSocketProtocol attribute in your code.
