Red Hat Summit Red Hat Summit지원콘솔개발자평가판 시작연락처

이 콘텐츠는 선택한 언어로 제공되지 않습니다.

4.3. SSL/TLS Protocol Version

Overview
링크 복사

The versions of the SSL/TLS protocol that are supported by Apache CXF depend on the particular JSSE provider configured. By default, the JSSE provider is configured to be SUN’s JSSE provider implementation.
Warning
If you are using SSL/TLS security, you must ensure that you have applied the latest security patches for JBoss Fuse, in order to disable the SSLv3 protocol (see Poodle vulnerability (CVE-2014-3566)). For more details, see Disabling SSLv3 in JBoss Fuse 6.x and JBoss A-MQ 6.x.

SSL/TLS protocol versions supported by SunJSSE
링크 복사

Table 4.2, “SSL/TLS Protocols Supported by SUN’s JSSE Provider” shows the SSL/TLS protocol versions supported by SUN’s JSSE provider.
Expand
Table 4.2. SSL/TLS Protocols Supported by SUN’s JSSE Provider
ProtocolDescription
SSLv2Hello
Do not use! (POODLE security vulnerability)
SSLv3
Do not use! (POODLE security vulnerability)
TLSv1
Supports TLS version 1
TLSv1.1Supports TLS version 1.1 (JDK 7 or later)
TLSv1.2Supports TLS version 1.2 (JDK 7 or later)

Excluding specific SSL/TLS protocol versions
링크 복사

Because of the Poodle vulnerability (CVE-2014-3566), it is important to exclude the SSLv3 protocol (and earlier protocols). The capability to exclude unwanted SSL/TLS protocols from your Apache CXF endpoints depends on the JBoss Fuse 6.2.0 patch level, as follows:
No patch
No capability to exclude vulnerable protocols from CXF endpoints (the secureSocketProtocol attribute is available, but is not effective at restricting the available protocols).
Rollup 1 Patch 2 (R1P2)
SSLv3 and earlier protocols automatically excluded (hard-coded in the runtime).
Rollup 2 Patch 1 (R2P1)
SSLv3 and earlier protocols automatically excluded (hard-coded in the runtime), and sec:excludeProtocols element supported.

Client side SSL/TLS protocol version
링크 복사

(Available only with Rollup 2 Patch 1) To exclude all protocols except for TLS version 1.2 on the client side, configure the sec:excludeProtocols element as follows (assuming you are using JDK 7 or later): 
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
  ...
  <http:conduit name="{Namespace}PortName.http-conduit">
    ...
    <http:tlsClientParameters>
      ...
      <sec:excludeProtocols>
        <sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
        <sec:excludeProtocol>SSLv3</sec:excludeProtocol>
        <sec:excludeProtocol>TLSv1</sec:excludeProtocol>
        <sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
      </sec:excludeProtocols>
    </http:tlsClientParameters>
  </http:conduit>
  ...
</beans>
Copy to Clipboard Toggle word wrap
Important
It is recommended that you always exclude the SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).

Server side SSL/TLS protocol version
링크 복사

(Available only with Rollup 2 Patch 1) To exclude all protocols except for TLS version 1.2 on the server side, configure the sec:excludeProtocols element as follows (assuming you are using JDK 7 or later): 
<?xml version="1.0" encoding="UTF-8"?>
<beans ... >
  ...
  <httpj:engine-factory bus="cxf">
    <httpj:engine port="9001">
      ...
      <httpj:tlsServerParameters>
        ...
        <sec:excludeProtocols>
          <sec:excludeProtocol>SSLv2Hello</sec:excludeProtocol>
          <sec:excludeProtocol>SSLv3</sec:excludeProtocol>
          <sec:excludeProtocol>TLSv1</sec:excludeProtocol>
          <sec:excludeProtocol>TLSv1.1</sec:excludeProtocol>
        </sec:excludeProtocols>
      </httpj:tlsClientParameters>
    </httpj:engine>
  </httpj:engine-factory>
  ...
</beans>
Copy to Clipboard Toggle word wrap
Important
It is recommended that you always exclude the SSLv2Hello and SSLv3 protocols, to protect against the Poodle vulnerability (CVE-2014-3566).

secureSocketProtocol attribute
링크 복사

Both the http:tlsClientParameters element and the httpj:tlsServerParameters element support the secureSocketProtocol attribute, which enables you to specify a particular protocol.
The semantics of this attribute are confusing, however: this attribute forces CXF to pick an SSL provider that supports the specified protocol, but it does not restrict the provider to use only the specified protocol. Hence, the endpoint could end up using a protocol that is different from the one specified. For this reason, we recommend that you do not use the secureSocketProtocol attribute in your code.
맨 위로 이동
Red Hat logoGithubredditYoutubeTwitter

자세한 정보

평가판, 구매 및 판매

커뮤니티

Red Hat 문서 정보

Red Hat을 사용하는 고객은 신뢰할 수 있는 콘텐츠가 포함된 제품과 서비스를 통해 혁신하고 목표를 달성할 수 있습니다. 최신 업데이트를 확인하세요.

보다 포괄적 수용을 위한 오픈 소스 용어 교체

Red Hat은 코드, 문서, 웹 속성에서 문제가 있는 언어를 교체하기 위해 최선을 다하고 있습니다. 자세한 내용은 다음을 참조하세요.Red Hat 블로그.

Red Hat 소개

Red Hat은 기업이 핵심 데이터 센터에서 네트워크 에지에 이르기까지 플랫폼과 환경 전반에서 더 쉽게 작업할 수 있도록 강화된 솔루션을 제공합니다.

Theme

© 2025 Red Hat