Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

このコンテンツは選択した言語では利用できません。

4.3. SSL/TLS Protocol Version

Overview
リンクのコピー

The versions of the SSL/TLS protocol that are supported by Apache CXF depend on the particular JSSE provider configured. By default, the JSSE provider is configured to be SUN’s JSSE provider implementation.
Warning
If you are using SSL/TLS security, you must ensure that you have applied the latest security patches for JBoss Fuse, in order to disable the SSLv3 protocol (see Poodle vulnerability (CVE-2014-3566)). For more details, see Disabling SSLv3 in JBoss Fuse 6.x and JBoss A-MQ 6.x.

SSL/TLS protocol versions supported by SunJSSE
リンクのコピー

Table 4.2, “SSL/TLS Protocols Supported by SUN’s JSSE Provider” shows the SSL/TLS protocol versions supported by SUN’s JSSE provider.
Expand
Table 4.2. SSL/TLS Protocols Supported by SUN’s JSSE Provider
ProtocolDescription
SSLv2Hello
Do not use! (POODLE security vulnerability)
SSLv3
Do not use! (POODLE security vulnerability)
TLSv1
Supports TLS version 1
TLSv1.1Supports TLS version 1.1 (JDK 7 or later)
TLSv1.2Supports TLS version 1.2 (JDK 7 or later)

Excluding specific SSL/TLS protocol versions
リンクのコピー

Because of the Poodle vulnerability (CVE-2014-3566), it is important to exclude the SSLv3 protocol (and earlier protocols). The capability to exclude unwanted SSL/TLS protocols from your Apache CXF endpoints depends on the JBoss Fuse 6.2.0 patch level, as follows:
No patch
No capability to exclude vulnerable protocols from CXF endpoints (the secureSocketProtocol attribute is available, but is not effective at restricting the available protocols).
Rollup 1 Patch 2 (R1P2)
SSLv3 and earlier protocols automatically excluded (hard-coded in the runtime).
Rollup 2 Patch 1 (R2P1)
SSLv3 and earlier protocols automatically excluded (hard-coded in the runtime), and sec:excludeProtocols element supported.

Client side SSL/TLS protocol version
リンクのコピー

(Available only with Rollup 2 Patch 1) To exclude all protocols except for TLS version 1.2 on the client side, configure the sec:excludeProtocols element as follows (assuming you are using JDK 7 or later): 
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
  ...
  <http:conduit name="{Namespace}PortName.http-conduit">
    ...
    <http:tlsClientParameters>
      ...
      <sec:excludeProtocols>
        <sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
        <sec:excludeProtocol>SSLv3</sec:excludeProtocol>
        <sec:excludeProtocol>TLSv1</sec:excludeProtocol>
        <sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
      </sec:excludeProtocols>
    </http:tlsClientParameters>
  </http:conduit>
  ...
</beans>
Copy to Clipboard Toggle word wrap
Important
It is recommended that you always exclude the SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).

Server side SSL/TLS protocol version
リンクのコピー

(Available only with Rollup 2 Patch 1) To exclude all protocols except for TLS version 1.2 on the server side, configure the sec:excludeProtocols element as follows (assuming you are using JDK 7 or later): 
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
  ...
  <httpj:engine-factory bus="cxf">
    <httpj:engine port="9001">
      ...
      <httpj:tlsServerParameters>
        ...
        <sec:excludeProtocols>
          <sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
          <sec:excludeProtocol>SSLv3</sec:excludeProtocol>
          <sec:excludeProtocol>TLSv1</sec:excludeProtocol>
          <sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
        </sec:excludeProtocols>
      </httpj:tlsClientParameters>
    </httpj:engine>
  </httpj:engine-factory>
  ...
</beans>
Copy to Clipboard Toggle word wrap
Important
It is recommended that you always exclude the SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).

secureSocketProtocol attribute
リンクのコピー

Both the http:tlsClientParameters element and the httpj:tlsServerParameters element support the secureSocketProtocol attribute, which enables you to specify a particular protocol.
The semantics of this attribute are confusing, however: this attribute forces CXF to pick an SSL provider that supports the specified protocol, but it does not restrict the provider to use only the specified protocol. Hence, the endpoint could end up using a protocol that is different from the one specified. For this reason, we recommend that you do not use the secureSocketProtocol attribute in your code.
トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat