Skip to content

Commit

Permalink
Don't filter out TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (netty#9274)
Browse files Browse the repository at this point in the history
Motivation:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is supported since Java 8 (see https://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html) and belongs to the recommended configurations in many references, eg SSLabs (https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices) or Google Cloud Platform Restricted Profile.

Modifications:

Add TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 to default ciphers list.

Result:

TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 is enabled by default.
  • Loading branch information
slandelle authored and normanmaurer committed Jun 24, 2019
1 parent 265c745 commit 039087e
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions handler/src/main/java/io/netty/handler/ssl/SslUtils.java
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,7 @@ final class SslUtils {
defaultCiphers.add("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384");
defaultCiphers.add("TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256");
defaultCiphers.add("TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256");
defaultCiphers.add("TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384");
defaultCiphers.add("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA");
// AES256 requires JCE unlimited strength jurisdiction policy files.
defaultCiphers.add("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA");
Expand Down

0 comments on commit 039087e

Please sign in to comment.