The particular use-case I'm interested in is the running of jetty on IBM JVMs. Since the IBM JVM prefixes its cipher suites with SSL_, and ciphers matching this regex are considered naughty, jetty servers interacted with via ring-jetty-adapter are unable to run on https on IBM JVMs without severe hacks (think mutating via :configurator sort of hacks).
Since this functionality is exposed by jetty under the hood anyway, I reckon it wouldn't be a bad thing to expose it via ring-jetty-adapter. Something along the lines of :override-exclude-ciphers and override-exclude-protocols? Happy to PR.
a91d874 added the ability to extend the list of excluded ciphers by calling out to
SslContextFactory.addExcludeCipherSuites
. However, this operation is purely additive. There are use-cases for replacing the set of excluded cipher suites, andSslContextFactory
exposes this functionality throughSslContextFactory.setExcludeCipherSuites
.The particular use-case I'm interested in is the running of
jetty
on IBM JVMs. Since the IBM JVM prefixes its cipher suites withSSL_
, and ciphers matching this regex are considered naughty,jetty
servers interacted with viaring-jetty-adapter
are unable to run on https on IBM JVMs without severe hacks (think mutating via:configurator
sort of hacks).Since this functionality is exposed by
jetty
under the hood anyway, I reckon it wouldn't be a bad thing to expose it viaring-jetty-adapter
. Something along the lines of:override-exclude-ciphers
andoverride-exclude-protocols
? Happy to PR.Example jetty issues relating to the IBM thing: