Supported Cipher Suites Using the JSSE-Based SSL Implementation

Configuring SSL 12-17

12.12.3 Supported Cipher Suites

The set of cipher suites supported by the JDK default JSSE provider, SunJSSE, is available at the following URL: http:download.oracle.comjavase6docstechnotesguidessecuri tySunProviders.htmlSunJSSEProvider For backward compatibility, the JSSE-based SSL implementation accepts Certicom cipher suite names for cipher suites that are compatible with SunJSSE. See Cipher Suites in Understanding Security for Oracle WebLogic Server for a list of Certicom cipher suites. The Certicom cipher suite names are converted for you to SunJSSE equivalents, usually replacing the “TLS_” prefix with “SSL_”, as shown in Table 12–3 . Please keep the following in mind as you consider backward compatibility with Certicom cipher suites: ■ For operations where enabled or supported cipher suites are returned, both the Certicom and SunJSSE names of the cipher suites are returned. Note that the weblogic.security.SSL.disableJsseCipherSuiteAliases=true property, described in Table 12–2 , disables this behavior. ■ For operations where you specify enabled cipher suites, you can use either the equivalent Certicom cipher suite names, or the SunJSSE names. The Certicom cipher suites, and their SunJSSE equivalents, are listed in Table 12–3 . ■ The _DSS_ cipher suites requires certificates signed with DSS, the Digital Signature Standard defined by NIST FIPS Pub 186. DSA is the key generation scheme as described in FIPS 186. ■ The _anon_ cipher suites are disabled by default, and cannot be managed from the WebLogic Server Administration console. To enable one of these cipher suites, configure the ciphersuite element in the ssl element in the DOMAIN_ HOME\server\config\config.xml file, as follows: ssl nameexamplesServername enabledtrueenabled listen-port7002listen-port ciphersuiteSSL_DH_anon_EXPORT_WITH_DES40_CBC_SHAciphersuite ... ■ To use the Kerberos cipher suites TLS_KRB5_, you must have KDC accounts set up. See the Java Secure Socket Extension JSSE Reference Guide http:download.oracle.comjavase6docstechnotesguidesse curityjsseJSSERefGuide.htmlDebug for more details on the Kerberos requirements. By default, Certicom cipher suite names are converted to SunJSSE cipher suite names when WebLogic Server is configured to use the JSSE-based SSL implementation. Table 12–3 lists each cipher suite supported in the WebLogic Server Certicom SSL implementation and its SunJSSE equivalent. The TLS_ name is the Certicom cipher suite name; the SSL_ name is the equivalent SunJSSE provider cipher suite name. 1 This WebLogic system property is applicable to both the Certicom and JSSE-based SSL implementations. However, for JSSE, this property affects only the SSL calling code, not the JSSE-based implementation. For more information about the javax.net.debug system property and debugging the JSSE-based SSL implementation, see Debugging Utilities in the Java Secure Socket Extension JSSE Reference Guide at http:download.oracle.comjavase6docstechnotesguidessecurityjsseJSSERefGuide.htmlDebu g . 12-18 Securing Oracle WebLogic Server

12.12.4 Using Debugging with JSSE SSL