55

Java 7 disables TLS 1.1 and 1.2 for clients. From Java Cryptography Architecture Oracle Providers Documentation:

Although SunJSSE in the Java SE 7 release supports TLS 1.1 and TLS 1.2, neither version is enabled by default for client connections. Some servers do not implement forward compatibility correctly and refuse to talk to TLS 1.1 or TLS 1.2 clients. For interoperability, SunJSSE does not enable TLS 1.1 or TLS 1.2 by default for client connections.

I'm interested in enabling the protocols on a system wide setting (perhaps through a config file), and not a per-Java-application solution.

How do I administratively enable TLS 1.1 and 1.2 system wide?

Note: since POODLE, I would like to administratively disable SSLv3 system wide. (The problems with SSLv3 predate POODLE by at least 15 years, but Java/Oracle/Developers did not respect basic best practices, so users like you and me are left with cleaning up the mess).


Here's the Java version:

$ /Library/Java/JavaVirtualMachines/jdk1.7.0_07.jdk/Contents/Home/bin/java -version
java version "1.7.0_07"
Java(TM) SE Runtime Environment (build 1.7.0_07-b10)
Java HotSpot(TM) 64-Bit Server VM (build 23.3-b01, mixed mode)
1

6 Answers 6

33

You could just add the following property -Dhttps.protocols=TLSv1.1,TLSv1.2 which configures the JVM to specify which TLS protocol version should be used during https connections.

5
  • 6
    Please explain more of what this does. Otherwise, this is vague and potentially damaging in the wrong hands.
    – studiohack
    Jun 16, 2015 at 15:31
  • 1
    @Thomasz - I kind of agree with others here... How do I do it administratively on a system wide basis? Does it get added to a machine's configuration file? If so, what is the file and where do I add it?
    – jww
    Jun 17, 2015 at 1:02
  • 6
    maybye this link will help : blogs.oracle.com/java-platform-group/entry/… you can add -Dhttps.protocols property as a param in the command line example : java -jar yourapplication.jar -Dhttps.protocols=TLSv1.2 or somewhere in the application (server) configuration files. You can verify if it works by adding additional param: -Djavax.net.debug=all after that, when application will negotiation https connection, it will print all negotiation information, including protocol version which have been used Jul 10, 2015 at 9:26
  • This param (https.protocols) is configuring java virtual machine which protocol version should be used during https connection. Jul 10, 2015 at 9:38
  • 3
    @TomaszRebizant, yes, you're correct. For example, adding export JAVA_OPTS="-Dhttps.protocols=TLSv1.1,TLSv1.2" in Tomcat's setenv.sh enables both TLSv1 & TLSv2 for all SSL connections made from apps on the application server.
    – Zaki
    Oct 20, 2015 at 14:53
13

You could try adding something like the following to your startup script, assuming Java 1.7:

JAVACMD="$JAVACMD -Ddeployment.security.SSLv2Hello=false -Ddeployment.security.SSLv3=false -Ddeployment.security.TLSv1=false -D\ deployment.security.TLSv1.1=true -Ddeployment.security.TLSv1.2=true"

Some other suggestions: https://blogs.oracle.com/java-platform-group/entry/java_8_will_use_tls

4
  • where you found these propeties documentation , I dont see anywhere they mention in JAVA7 docs for "-D deployment.security.{ProtocolName} = True/False;"
    – runcode
    Oct 22, 2014 at 20:35
  • @runcode, not exactly sure, but it is mentioned in the oracle.com blog that is referenced above
    – cnst
    Oct 24, 2014 at 5:22
  • 1
    @cnst - the problem here is I need to contact every developer of every piece of Java software, and tell them to do this. Hence the reason I want to do it administratively once on my machine.
    – jww
    Jun 17, 2015 at 0:54
  • 1
    Didn't work for me. Jul 13, 2018 at 18:37
8

For Java 7 on Mac OS X, you go to System Preferences > Java, and the Java Control Panel opens in a separate window. Then you go to the Advanced tab and scroll down to the Advanced Security Settings section and check the Use TLS 1.1 and Use TLS 1.2 checkboxes.

enter image description here

3
  • Thanks Spiff. I'm already set up for TLS 1.0 and above as you have shown. However, when I create a SSLSocket (and I assume this happens to other Java programs), TLS 1.0 is enabled (and TLS 1.1 and 1.2 are available).
    – jww
    Apr 29, 2014 at 8:51
  • 3
    You can test this on your system, too (if interested). Download ProtocolTest.java from this bug report and execute it. To compile and execute, run javac ProtocolTest.java && java ProtocolTest in a terminal. See what shows up under Enabled Protocols.
    – jww
    Apr 29, 2014 at 9:30
  • 2
    This only works for WebStart Clients and Applets. It does not affect application servers started with java executable.
    – eckes
    Jan 24, 2017 at 16:54
8

I just recently researched this and i want to add - this will not work for JDK , the deployment.properties only relevant to Applets and other stuff running in the JRE.

for JDK applications (a server which needs to connect to LDAP for example) the server is a client but the deployment.security. would not work.

no way to change it unless you write some code like SSLContext.getInstance("TLSv1.2");

4

It looks like deployment.security.* settings work for Java Applets and Java Web Start programs running on a desktop. As others mention here you can edit deployment.properties to specify that.

Here is an article that shows how to use a group policy to deploy the same deployment.properties file for all users: http://www.darkoperator.com/blog/2013/1/12/pushing-security-configuration-for-java-7-update-10-via-gpo.html

Unfortunately there is no way to turn this on for all java programs on a computer that directly call java.exe or javaw.exe. You have to find each program that uses java, find the config file where you specify the parameters to pass to java and change it.

For Tomcat we had to pass this so that connections from Tomcat to other servers use TLS 1.1+: -Dhttps.protocols=TLSv1.1,TLSv1.2. On Linux this can be done by editing bin/catalina.sh or by creating bin/setenv.sh.

I don't know what it takes to make Tomcat use only TLS 1.2 on the server side. We front with Apache HTTP.

1

If you are stuck with Java 7, you can add -Djdk.tls.client.protocols=TLSv1.1,TLSv1.2 to the arguments of the JVM.

Note that this has several caveats:

In spite of these shortcomings, I think that this could be useful, especially when the protocol one is interested in uses TLS but is not HTTPS, e.g. LDAPS.

[UPDATE] In my company, which runs its pool of servers on Ubuntu, we've realized that even update 121 of OpenJDK 7 was not enough to implement this correctly. We've updated all servers to update 181 before it worked.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .