Start of changes for service refresh 6 fix pack 25

Specifying default enabled cipher suites

You can specify the default enabled cipher suites in your application or with the system properties jdk.tls.client.cipherSuites and jdk.tls.server.cipherSuites.

Note: The actual use of enabled cipher suites is restricted by algorithm constraints.

The set of cipher suites to enable by default is determined by one of the following ways in this order of preference:

  1. Explicitly set by application
  2. Specified by system property
  3. Specified by JSSE provider defaults

For example, explicitly setting the default enabled cipher suites in your application overrides settings specified in jdk.tls.client.cipherSuites or jdk.tls.server.cipherSuites as well as JSSE provider defaults.

Explicitly Set by Application

You can set which cipher suites are enabled with one of the following methods:
  • SSLSocket.setEnabledCipherSuites(String[])
  • SSLEngine.setEnabledCipherSuites(String[])
  • SSLServerSocket.setEnabledCipherSuites(String[])
  • SSLParameters(String[] cipherSuites)
  • SSLParameters(String[] cipherSuites, String[] protocols)
  • SSLParameters.setCipherSuites(String[])
  • https.cipherSuites system property for HttpsURLConnection

Specified by System Property

The system property jdk.tls.client.cipherSuites specifies the default enabled cipher suites on the client side; jdk.tls.server.cipherSuites specifies those on the server side.

The syntax of the value of these two system properties is a comma-separated list of supported cipher suite names. Unrecognized or unsupported cipher suite names that are specified in these properties are ignored. See Java Cryptography Extension API Specification and Reference Appendix A: Standard Names for standard JSSE cipher suite names.

Attention: These system properties can be used to configure weak cipher suites, or the configured cipher suites may be weak in the future. It is not recommended that you use these system properties without understanding the risks.

Specified by JSSE Provider Defaults

Each JSSE provider has its own default enabled cipher suites. See Cipher suites for the cipher suite names that are supported by the IBMJSSE2 provider and which ones are enabled by default.

End of changes for service refresh 6 fix pack 25