title: Force JVM to use certain Cipher for https connections
body: <p>I have Java client which connects to certain web services using https. One of the requirement of the client is that, we should be able to select from the list of supported cipher suites and then force the client to use them. </p>
  
  <p>From the following <a href="https://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html" rel="nofollow">page</a> </p>
  
  <blockquote>
    <ul>
    <li>https.cipherSuites system property. This contains a comma-separated list of cipher suite names specifying which cipher suites to enable
    for use on this HttpsURLConnection. See the SSLSocket
    setEnabledCipherSuites(String[]) method.</li>
    </ul>
  </blockquote>
  
  <p>But when I set this JVM attribute and list the default ciphers. I get the standard enabled Cipher list which is same as when not using this property.</p>
  
  <p>Code I am using to list the enabled ciphers:</p>
  
  <pre><code>SSLSocketFactory factory = HttpsURLConnection.getDefaultSSLSocketFactory();
  SSLSocket socket = (SSLSocket) factory.createSocket();
  
  String[] enabledCiphers = socket.getEnabledCipherSuites();
  
  for (String enabledCipher : enabledCiphers) {
      System.out.println("Enabled Ciphers: " + enabledCipher);
  }
  </code></pre>
  
  <p>Setting the property using:</p>
  
  <pre><code>-Dhttps.cipherSuites=SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA,SSL_DHE_DSS_WITH_DES_CBC_SHA
  </code></pre>
  
  <p>Any suggestions?</p>