title: Disabling specific weak ciphers and enforcing Perfect Forward Secrecy using JVM properties
body: <p>I want to achieve the Perfect Forward Secrecy (<a href="https://blogs.oracle.com/java-platform-group/entry/java_8_will_use_tls" rel="nofollow noreferrer">PFS</a>) by disabling the unwanted ciphers using JVM properties</p>
  
  <p>I want to achieve this by using Java's 'jdk.tls.disabledAlgorithms' property in java.security file. </p>
  
  <p>Currently I set the property as below 
  jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, MD5, DESede, DH keySize &lt; 1024, RSA keySize &lt; 2048 and when I tested using the Server using TestSSLServer, I got the following output</p>
  
  <pre><code>  Supported versions: TLSv1.2
  Deflate compression: no
  Supported cipher suites (ORDER IS NOT SIGNIFICANT):
    TLSv1.2
       RSA_WITH_AES_128_CBC_SHA
       DHE_RSA_WITH_AES_128_CBC_SHA
       RSA_WITH_AES_256_CBC_SHA
       DHE_RSA_WITH_AES_256_CBC_SHA
       RSA_WITH_AES_128_CBC_SHA256
       RSA_WITH_AES_256_CBC_SHA256
       DHE_RSA_WITH_AES_128_CBC_SHA256
       DHE_RSA_WITH_AES_256_CBC_SHA256
       TLS_RSA_WITH_AES_128_GCM_SHA256
       TLS_RSA_WITH_AES_256_GCM_SHA384
       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  </code></pre>
  
  <p>I still couldn't find a mechanism to get rid of sites that don't provide PFS. E.g. ' TLS_RSA_WITH_AES_128_GCM_SHA256'.</p>
  
  <p>Can I get this done by 'jdk.tls.disabledAlgorithms'? If not, is there any other JVM level mechanism?</p>