{"action":"created","issue":{"url":"https://api.github.com/repos/eclipse/jetty.project/issues/860","repository_url":"https://api.github.com/repos/eclipse/jetty.project","labels_url":"https://api.github.com/repos/eclipse/jetty.project/issues/860/labels{/name}","comments_url":"https://api.github.com/repos/eclipse/jetty.project/issues/860/comments","events_url":"https://api.github.com/repos/eclipse/jetty.project/issues/860/events","html_url":"https://github.com/eclipse/jetty.project/issues/860","id":172327115,"number":860,"title":"Only TLS 1.2 Supported","user":{"login":"nickbabcock","id":2106129,"avatar_url":"https://avatars.githubusercontent.com/u/2106129?v=3","gravatar_id":"","url":"https://api.github.com/users/nickbabcock","html_url":"https://github.com/nickbabcock","followers_url":"https://api.github.com/users/nickbabcock/followers","following_url":"https://api.github.com/users/nickbabcock/following{/other_user}","gists_url":"https://api.github.com/users/nickbabcock/gists{/gist_id}","starred_url":"https://api.github.com/users/nickbabcock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nickbabcock/subscriptions","organizations_url":"https://api.github.com/users/nickbabcock/orgs","repos_url":"https://api.github.com/users/nickbabcock/repos","events_url":"https://api.github.com/users/nickbabcock/events{/privacy}","received_events_url":"https://api.github.com/users/nickbabcock/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":{"login":"WalkerWatch","id":1237580,"avatar_url":"https://avatars.githubusercontent.com/u/1237580?v=3","gravatar_id":"","url":"https://api.github.com/users/WalkerWatch","html_url":"https://github.com/WalkerWatch","followers_url":"https://api.github.com/users/WalkerWatch/followers","following_url":"https://api.github.com/users/WalkerWatch/following{/other_user}","gists_url":"https://api.github.com/users/WalkerWatch/gists{/gist_id}","starred_url":"https://api.github.com/users/WalkerWatch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WalkerWatch/subscriptions","organizations_url":"https://api.github.com/users/WalkerWatch/orgs","repos_url":"https://api.github.com/users/WalkerWatch/repos","events_url":"https://api.github.com/users/WalkerWatch/events{/privacy}","received_events_url":"https://api.github.com/users/WalkerWatch/received_events","type":"User","site_admin":false},"assignees":[{"login":"WalkerWatch","id":1237580,"avatar_url":"https://avatars.githubusercontent.com/u/1237580?v=3","gravatar_id":"","url":"https://api.github.com/users/WalkerWatch","html_url":"https://github.com/WalkerWatch","followers_url":"https://api.github.com/users/WalkerWatch/followers","following_url":"https://api.github.com/users/WalkerWatch/following{/other_user}","gists_url":"https://api.github.com/users/WalkerWatch/gists{/gist_id}","starred_url":"https://api.github.com/users/WalkerWatch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/WalkerWatch/subscriptions","organizations_url":"https://api.github.com/users/WalkerWatch/orgs","repos_url":"https://api.github.com/users/WalkerWatch/repos","events_url":"https://api.github.com/users/WalkerWatch/events{/privacy}","received_events_url":"https://api.github.com/users/WalkerWatch/received_events","type":"User","site_admin":false}],"milestone":null,"comments":3,"created_at":"2016-08-21T15:52:16Z","updated_at":"2016-08-22T15:50:26Z","closed_at":null,"body":"By default Jetty seems to support TLS 1.2 with no way to configure this.\r\n\r\n- [Download jetty distribution 9.3.11.v20160721](http://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.3.11.v20160721/jetty-distribution-9.3.11.v20160721.tar.gz)\r\n- `java -jar $JETTY_HOME/start.jar --add-to-startd=https`\r\n- Run [sslyze](https://github.com/nabla-c0d3/sslyze) (or your favorite ssl analyzer) and notice that only TLS 1.2 is supported\r\n- edit `${jetty.base}/jetty-distribution-9.3.11.v20160721/etc/jetty-ssl-context.xml` and add\r\n\r\n```xml\r\n<Call name=\"setIncludeProtocols\">\r\n  <Arg>\r\n    <Array type=\"String\">\r\n      <Item>TLSv1</Item>\r\n      <Item>TLSv1.1</Item>\r\n      <Item>TLSv1.2</Item>\r\n    </Array>\r\n  </Arg>\r\n</Call>\r\n<Call name=\"addExcludeCipherSuites\">\r\n  <Arg>\r\n    <Array type=\"String\">\r\n      <Item>.*NULL.*</Item>\r\n      <Item>.*RC4.*</Item>\r\n      <Item>.*MD5.*</Item>\r\n      <Item>.*DES.*</Item>\r\n      <Item>.*DSS.*</Item>\r\n    </Array>\r\n  </Arg>\r\n</Call>\r\n```\r\n\r\n- Restart jetty and notice that this doesn't change anything (though mistyping a protocol will make jetty print a warning, so jetty is picking up the protocols)\r\n- Try and disable TLS 1.2\r\n\r\n```xml\r\n  <Call name=\"setIncludeProtocols\">\r\n    <Arg>\r\n      <Array type=\"String\">\r\n        <Item>TLSv1</Item>\r\n        <Item>TLSv1.1</Item>\r\n      </Array>\r\n    </Arg>\r\n  </Call>\r\n  <Call name=\"setExcludeProtocols\">\r\n    <Arg>\r\n      <Array type=\"String\">\r\n        <Item>TLSv1.2</Item>\r\n      </Array>\r\n    </Arg>\r\n  </Call>\r\n```\r\n\r\n- Jetty will start but will refuse to complete any request with an error detailing that no cipher suite in common\r\n\r\nI'm assuming this is a bug as the [documentation states that](https://www.eclipse.org/jetty/documentation/9.3.x/configuring-ssl.html)\r\n\r\n> Both TLS v1.0 and SSL v3 are no longer supported by default.\r\n\r\nWhich leads me to believe that TLS v1.1 would be on by default and that TLS v1.0 could be enabled through configuration.\r\n\r\nOriginally reported https://github.com/dropwizard/dropwizard/issues/1700\r\n\r\nEDIT: env info:\r\n\r\n```\r\njava version \"1.8.0_101\"\r\nJava(TM) SE Runtime Environment (build 1.8.0_101-b13)\r\nJava HotSpot(TM) 64-Bit Server VM (build 25.101-b13, mixed mode)\r\n```\r\n\r\n```\r\nNAME=\"Ubuntu\"\r\nVERSION=\"14.04.5 LTS, Trusty Tahr\"\r\nID=ubuntu\r\nID_LIKE=debian\r\nPRETTY_NAME=\"Ubuntu 14.04.5 LTS\"\r\nVERSION_ID=\"14.04\"\r\n```\r\n\r\nEDIT: after additional searching: I've come across a [post](http://shibboleth.net/pipermail/users/2016-March/028122.html) that mentions a post on the [mailing list](http://dev.eclipse.org/mhonarc/lists/jetty-users/msg06782.html) saying that this behavior is desired. If this is the case, this issue may be closed at the team's discretion, but the docs that I linked to must be updated to note that only TLS 1.2 is supported without specifying `excludeCipherSuites`\r\n\r\nEDIT: For those that want Jetty 9.3.7+ but want TLS 1 and TLS 1.1, which Jetty has excluded known vulnerable cipher suites, I can confirm that setting the excluded cipher suites to the following list works.\r\n\r\n```xml\r\n  <Call name=\"setExcludeCipherSuites\">\r\n    <Arg>\r\n      <Array type=\"String\">\r\n        <Item>SSL_RSA_WITH_DES_CBC_SHA</Item>\r\n        <Item>SSL_DHE_RSA_WITH_DES_CBC_SHA</Item>\r\n        <Item>SSL_DHE_DSS_WITH_DES_CBC_SHA</Item>\r\n        <Item>SSL_RSA_EXPORT_WITH_RC4_40_MD5</Item>\r\n        <Item>SSL_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>\r\n        <Item>SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA</Item>\r\n        <Item>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</Item>\r\n      </Array>\r\n    </Arg>\r\n  </Call>\r\n```"},"comment":{"url":"https://api.github.com/repos/eclipse/jetty.project/issues/comments/241457629","html_url":"https://github.com/eclipse/jetty.project/issues/860#issuecomment-241457629","issue_url":"https://api.github.com/repos/eclipse/jetty.project/issues/860","id":241457629,"user":{"login":"nickbabcock","id":2106129,"avatar_url":"https://avatars.githubusercontent.com/u/2106129?v=3","gravatar_id":"","url":"https://api.github.com/users/nickbabcock","html_url":"https://github.com/nickbabcock","followers_url":"https://api.github.com/users/nickbabcock/followers","following_url":"https://api.github.com/users/nickbabcock/following{/other_user}","gists_url":"https://api.github.com/users/nickbabcock/gists{/gist_id}","starred_url":"https://api.github.com/users/nickbabcock/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nickbabcock/subscriptions","organizations_url":"https://api.github.com/users/nickbabcock/orgs","repos_url":"https://api.github.com/users/nickbabcock/repos","events_url":"https://api.github.com/users/nickbabcock/events{/privacy}","received_events_url":"https://api.github.com/users/nickbabcock/received_events","type":"User","site_admin":false},"created_at":"2016-08-22T15:50:26Z","updated_at":"2016-08-22T15:50:26Z","body":"Good point, I will have to report back if I can replicate the following [stackoverflow answer](http://stackoverflow.com/a/33122393/433785).\r\n\r\nBut that is a Java only solution. I do find it peculiar that I am unable to get OpenSSL 1.0.2e to successfully negotiate a TLS/1.1 connection with the default excluded cipher suites. `openssl s_client -prexit -tls1_1 -connect <host>:<port>` fails to return the server's certificate."}}
{"actor":{"display_login":"nickbabcock"}}