Red Hat Summit Red Hat SummitSupportConsoleDéveloppeursCommencer un essaiContact

Ce contenu n'est pas disponible dans la langue sélectionnée.

4.3. SSL/TLS Protocol Version

Overview
Copier lien

The versions of the SSL/TLS protocol that are supported by Apache CXF depend on the particular JSSE provider configured. By default, the JSSE provider is configured to be SUN’s JSSE provider implementation.
Warning
If you are using SSL/TLS security, you must ensure that you have applied the latest security patches for JBoss Fuse, in order to disable the SSLv3 protocol (see Poodle vulnerability (CVE-2014-3566)). For more details, see Disabling SSLv3 in JBoss Fuse 6.x and JBoss A-MQ 6.x.

SSL/TLS protocol versions supported by SunJSSE
Copier lien

Table 4.2, “SSL/TLS Protocols Supported by SUN’s JSSE Provider” shows the SSL/TLS protocol versions supported by SUN’s JSSE provider.
Expand
Table 4.2. SSL/TLS Protocols Supported by SUN’s JSSE Provider
ProtocolDescription
SSLv2Hello
Do not use! (POODLE security vulnerability)
SSLv3
Do not use! (POODLE security vulnerability)
TLSv1
Supports TLS version 1
TLSv1.1Supports TLS version 1.1 (JDK 7 or later)
TLSv1.2Supports TLS version 1.2 (JDK 7 or later)

Excluding specific SSL/TLS protocol versions
Copier lien

Because of the Poodle vulnerability (CVE-2014-3566), it is important to exclude the SSLv3 protocol (and earlier protocols). The capability to exclude unwanted SSL/TLS protocols from your Apache CXF endpoints depends on the JBoss Fuse 6.2.0 patch level, as follows:
No patch
No capability to exclude vulnerable protocols from CXF endpoints (the secureSocketProtocol attribute is available, but is not effective at restricting the available protocols).
Rollup 1 Patch 2 (R1P2)
SSLv3 and earlier protocols automatically excluded (hard-coded in the runtime).
Rollup 2 Patch 1 (R2P1)
SSLv3 and earlier protocols automatically excluded (hard-coded in the runtime), and sec:excludeProtocols element supported.

Client side SSL/TLS protocol version
Copier lien

(Available only with Rollup 2 Patch 1) To exclude all protocols except for TLS version 1.2 on the client side, configure the sec:excludeProtocols element as follows (assuming you are using JDK 7 or later): 
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
  ...
  <http:conduit name="{Namespace}PortName.http-conduit">
    ...
    <http:tlsClientParameters>
      ...
      <sec:excludeProtocols>
        <sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
        <sec:excludeProtocol>SSLv3</sec:excludeProtocol>
        <sec:excludeProtocol>TLSv1</sec:excludeProtocol>
        <sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
      </sec:excludeProtocols>
    </http:tlsClientParameters>
  </http:conduit>
  ...
</beans>
Copy to Clipboard Toggle word wrap
Important
It is recommended that you always exclude the SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).

Server side SSL/TLS protocol version
Copier lien

(Available only with Rollup 2 Patch 1) To exclude all protocols except for TLS version 1.2 on the server side, configure the sec:excludeProtocols element as follows (assuming you are using JDK 7 or later): 
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
  ...
  <httpj:engine-factory bus="cxf">
    <httpj:engine port="9001">
      ...
      <httpj:tlsServerParameters>
        ...
        <sec:excludeProtocols>
          <sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
          <sec:excludeProtocol>SSLv3</sec:excludeProtocol>
          <sec:excludeProtocol>TLSv1</sec:excludeProtocol>
          <sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
        </sec:excludeProtocols>
      </httpj:tlsClientParameters>
    </httpj:engine>
  </httpj:engine-factory>
  ...
</beans>
Copy to Clipboard Toggle word wrap
Important
It is recommended that you always exclude the SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).

secureSocketProtocol attribute
Copier lien

Both the http:tlsClientParameters element and the httpj:tlsServerParameters element support the secureSocketProtocol attribute, which enables you to specify a particular protocol.
The semantics of this attribute are confusing, however: this attribute forces CXF to pick an SSL provider that supports the specified protocol, but it does not restrict the provider to use only the specified protocol. Hence, the endpoint could end up using a protocol that is different from the one specified. For this reason, we recommend that you do not use the secureSocketProtocol attribute in your code.
Retour au début
Red Hat logoGithubredditYoutubeTwitter

Apprendre

Essayez, achetez et vendez

Communautés

À propos de la documentation Red Hat

Nous aidons les utilisateurs de Red Hat à innover et à atteindre leurs objectifs grâce à nos produits et services avec un contenu auquel ils peuvent faire confiance. Découvrez nos récentes mises à jour.

Rendre l’open source plus inclusif

Red Hat s'engage à remplacer le langage problématique dans notre code, notre documentation et nos propriétés Web. Pour plus de détails, consultez le Blog Red Hat.

À propos de Red Hat

Nous proposons des solutions renforcées qui facilitent le travail des entreprises sur plusieurs plates-formes et environnements, du centre de données central à la périphérie du réseau.

Theme

© 2025 Red Hat