Enable the restriction of supported TLS protocols and ciphers suites …

[pscosta]

This enables the restriction of supported TLS protocols and ciphers suites while configuring the UndertowEmbeddedServletContainerFactory, populating the default Ssl configuration object, without having to go through the Customizers logic.

[philwebb]

Thanks. Have you signed the CLA?

[pscosta]

Hi! I'm waiting for my employer's feedback on that.. :)

[pscosta]

Yes, I have signed it: 157820160108113150

Regards,
Pedro Costa

From: Phil Webb [mailto:notifications@github.com]
Sent: Wednesday, December 23, 2015 7:30 PM
To: spring-projects/spring-boot
Cc: Costa, Pedro (EXT-RandstadTechnologies - PT/Lisbon)
Subject: Re: [spring-boot] Enable the restriction of supported TLS protocols and ciphers suites … (#4823)

Thanks. Have you signed the CLAhttps://github.com/spring-projects/spring-boot/blob/master/CONTRIBUTING.adoc#sign-the-contributor-license-agreement?

—
Reply to this email directly or view it on GitHubhttps://github.com//pull/4823#issuecomment-166975934.

[wilkinsona]

@pscosta I don't think we can merge this without also supporting it with Tomcat and Jetty. Would you like to add that to this PR?

[pscosta]

@wilkinsona I have added support for Tomcat and Jetty.

[wilkinsona]

@pscosta Great stuff. Thanks very much

[wilkinsona]

See #2109

[wilkinsona]

@pscosta Thanks again for the pull request. I've merged in into master and it'll be in 1.4.0.M1.

[whgibbo]

Hi,
Am I right in the thinking that the property is security.ssl.enabledProtocols ?

So if have the following yml:

server:
    port: 8443
    ssl:
        enabled: true
        protocol: TLS
        enabledProtocols: 
            - TLSv1.2

With the appropriate key-alias and key-store information it should then disable TLS1 and TLS1.1 ?
What is the best way to verify that it is disabled?

Thanks

[wilkinsona]

Am I right in the thinking that the property is security.ssl.enabledProtocols ?

It's server.ssl.enabledProtocols (as you have in your YAML).

What is the best way to verify that it is disabled?

Try to connect using a protocol that isn't enabled. This isn't Spring Boot-specific. One way to do that would be with openssl on the command line. If you Google, you'll find lots of examples.

[ouaibsky]

Hi,
Any chance to get this enhancement part of 1.3..X release train ?
Thx

Christophe

[philwebb]

@ouaibsky I'm afraid not. 1.3.x is in "bug fix only" mode and this is definitely an enhancement.

[ouaibsky]

ok, thx