Specifying limited set of SSL Ciphersuites doesn't seam to work
Hello everyone,
I'm trying to react on a security scan where one of the findings was weak ciphers for WebLogic SSL connections.
After a bit of investigation I found few cipher suites which are strong and I want my WebLogic instances to use only those.
To do so I specified:
-Dweblogic.security.SSL.Ciphersuites=TLS_RSA_WITH_AES_128_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA
on the Java command line (server start). With all SSL debug options I get the following output in the log:
...weblogic.security.SSL.Ciphersuites = TLS_RSA_WITH_AES_128_CBC_SHA,SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA
0