Patch Reviews - Middleware (MOSC)

MOSC Banner

Disable SSL in WebLogic 10.3.2

edited Jan 29, 2019 4:05AM in Patch Reviews - Middleware (MOSC) 1 commentAnswered

The current JAVA_OPTIONS settings in setDomainEnv.sh doesn't help me disable SSL v2 and v3.

-Dweblogic.security.SSL.allowSmallRSAExponent=true

-Dweblogic.security.SSL.enforceConstraints=off

-Dweblogic.ssl.JSSEEnabled=true

-Dweblogic.security.SSL.enableJSSE=true

-Dweblogic.security.SSL.minimumProtocolVersion=TLSv1.1

-Djdk.tls.client.protocols=TLSv1.1,TLSv1.2

-Dweblogic.ssl.SSLv2HelloEnabled=false

Am I missing anything here or set any of the above system properties incorrect? The security scan still comes up with the following vulnerabilities:

SSLv2 is enabled and the server supports at least one cipher

SSLv3 is enabled and the server supports at least one cipher

How can I address the above vulnerabilities?

Howdy, Stranger!

Log In

To view full details, sign in to My Oracle Support Community.

Register

Don't have a My Oracle Support Community account? Click here to get started.

Category Leaderboard

Top contributors this month

New to My Oracle Support Community? Visit our Welcome Center

MOSC Help Center