Jetty TLS 1.3 CipherSuites

mozilla / ssl-config-generator

Mozilla SSL Configuration Generator

https://ssl-config.mozilla.org/

Mozilla Public License 2.0

360 stars 59 forks source link

Jetty TLS 1.3 CipherSuites #154

Open jonah-iden opened 3 years ago

jonah-iden commented 3 years ago

The generated intermediate Jetty SSL Configuration does not work with TLS1.3 because it specifies IncludeCipherSuites without specifing any TLS1.3 compatible ones as defined in RFC 8446. This of course would lead to a failed SSL Handshake with the Jetty server if only TLS1.3 was supported and leads to a downgrade to TLS1.2 otherwise.

mkjor commented 2 years ago

I ran into the same problem. The two Cipher Suites TLS_AES_128_GCM_SHA256 and TLS_AES_256_GCM_SHA384 should be added for TLSv1.3.

OpenJDK issue for Java 11 (section 5)
OpenJDK issue for Java 8 backport (section 5)

janbrasna commented 7 months ago

@jonah-iden @mkjor Thanks for catching this! Could you please try the configs from preview build: https://deploy-preview-24--mozsslconf-dev.netlify.app/#server=jetty that add the three default TLSv1.3 cipher suites to the top of the list for intermediate and old if that's all what is needed? (modern is left out for defaults…)

jonah-iden commented 7 months ago

On a first glance this looks good to me, but i sadly don't have a Jetty setup anymore i could test this with

janbrasna commented 7 months ago

Thanks, I was mostly concerned about including TLS_CHACHA20_POLY1305_SHA256 that gained support later for RFC compatibility JDK-8140466 — but the same would apply for already used TLSv1.2 ciphers so I assume if these were okay, probably just an extra comment mentioning 11.0.3 support would suffice. Thanks again for helping out making the configs right!