Page History

...

The TLS Parameters common to both Clients and Servers are given here:

Note that from CXF 3.0.3 and 2.7.14, the SSLv3 protocol is disabled on the client side, and on the service side (if Jetty is used), unless "SSLv3" is explicitly specified for the "secureSocketProtocol" parameter.

...

    <httpj:tlsServerParameters>
        ...
        <sec:trustManagers>
            <sec:keyStore type="jks" password="stsspass" resource="stsstore.jks" />
        </sec:trustManagers>
        ...
    </httpj:tlsServerParameters>

TLS CipherSuites

...

When CXF selects the CipherSuites to use in a TLS Connection, it selects them in the following order:

1. If we have defined explicit "cipherSuite" configuration (see below)
2. If we have defined ciphersuites via the system property "https.cipherSuites".
3. The default JVM CipherSuites, if no filters (see below) have been defined
4. Filter the supported cipher suites (*not* the default JVM CipherSuites)

CipherSuites

We can select explicit CipherSuites to use in configuration, for example:The CipherSuites Filter is used to either include or exclude particular CipherSuites. If no exclusion filter is specified, the default is to exclude all "NULL" and "anon" filters. CXF 3.0.3 onwards excludes all "DES" filters as well, and 3.0.4 onwards additionally excludes all "EXPORT" filters.

    <httpj:tlsServerParameters>
        ...
         <sec:cipherSuitesFilter>cipherSuites>
             <sec:include>.*_EXPORT_.*cipherSuite>TLS_AES_128_GCM_SHA256</sec:cipherSuite>
         </sec:include>cipherSuites>
        ...
    </httpj:tlsServerParameters>

CipherSuites Filter

The CipherSuites Filter is used to either include or exclude particular CipherSuites. An inclusion filter must be specified or else no ciphersuites will be included, the exclusion filter is optional. Please note that care must be taken when using ciphersuite filters, are they operate on all of the supported ciphersuites (as opposed to the default JVM ciphersuites that are used if no filter is specified). It is recommended instead to either select a specific CipherSuite (see above) or else just rely on the default JVM ciphersuites by not specifying any cipherSuite or cipherSuiteFilter configuration.

If no exclusion filter is specified, the default ciphersuites that are excluded are as follows. Note that if the user explicitly allows any of these in the inclusion filter, then they are not excluded by default. For example, if you want to allow "NULL" ciphersuites by adding an inclusion filter of ".*NULL.*" then this is removed from the default exclusion filters.

Example:

    <httpj:tlsServerParameters><sec:include>.*_EXPORT1024_.*</sec:include>
        ...
        <sec:include>.*_WITH_DES_.*</sec:include>cipherSuitesFilter>
            <sec:include>.*_WITH_AES_.*</sec:include>
            <sec:exclude>.*_DH_anon_.*</sec:exclude>
        </sec:cipherSuitesFilter>
        ...
    </httpj:tlsServerParameters>

...

In addition to the TLS Parameters common to both Clients and Servers, there are some parameters that are specific to Clients:

Disable CN Check

disableCNCheck is a parameterized boolean, you can use a fixed variable true|false as well as a Spring externalized property variable (e.g. ${disable-https-hostname-verification}) or a Spring expression (e.g. #{systemProperties['dev-mode']}).

...

In addition to the TLS Parameters common to both Clients and Servers, there are some parameters that are specific to Servers:

Client Authentication

This allows you to define whether client authentication is wanted and/or required.

...