Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-3734

(7.0.z) ELY-438 - There is not possibility to use alternative JSSE Cipher Suite Names for IBM JDK

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Critical
    • 7.0.6.CR1, 7.0.6.GA
    • 7.0.0.ER6
    • Security
    • None
    • EAP 7.0.6

    Description

      There is not possibility to use alternative JSSE Cipher Suite Names for IBM JDK8
      Interchange TLS prefix to SSL and vice versa is not supported.

      Here is list of standard JSSE Cipher Suite Names
      http://docs.oracle.com/javase/8/docs/technotes/guides/security/StandardNames.html#ciphersuites

      In my opinion this file is mapping file for our purpose. It is?
      https://github.com/wildfly-security/wildfly-elytron/blob/master/src/main/java/org/wildfly/security/ssl/MechanismDatabase.properties

      For IBM JDK are different JSSE Cipher Suite Names (different prefix).
      Most items from this list are missing in MechanismDatabase.properties mentioned above.
      http://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jsse2Docs/ciphersuites.html?lang=cs

      For example:
      JSSE Cipher Suite Name SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA is only defined for IBM JDK.
      It is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA for Oracle JDK.

      If I try start server with JSSE Cipher Suite Name SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA I will get this error:

      16:55:25,594 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-2) MSC000001: Failed to start service jboss.undertow.listener.https: org.jboss.msc.service.StartException in service jboss.undertow.listener.https: Failed to start service
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1904)
        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1153)
        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at java.lang.Thread.run(Thread.java:785)
Caused by: java.lang.IllegalArgumentException: ELY05017: Token "SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA" not allowed at offset 33 of mechanism selection string "SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA"
        at org.wildfly.security.ssl.CipherSuiteSelector.fromString(CipherSuiteSelector.java:399)
        at org.wildfly.extension.undertow.HttpsListenerService.startListening(HttpsListenerService.java:125)
        at org.wildfly.extension.undertow.ListenerService.start(ListenerService.java:138)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1948)
        at org.jboss.msc.service.ServiceControllerImpl$StartTask.run(ServiceControllerImpl.java:1881)
        ... 3 more

16:55:25,598 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) WFLYCTL0013: Operation ("add") failed - address: ([
    ("subsystem" => "undertow"),
    ("server" => "default-server"),
    ("https-listener" => "https")
]) - failure description: {"WFLYCTL0080: Failed services" => {"jboss.undertow.listener.https" => "org.jboss.msc.service.StartException in service jboss.undertow.listener.https: Failed to start service
    Caused by: java.lang.IllegalArgumentException: ELY05017: Token \"SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA\" not allowed at offset 33 of mechanism selection string \"SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA\""}}

      Attachments

        1. ca-cert.jks
          1 kB
        2. server-cert-key-rsa.jks
          2 kB
        3. standalone.xml
          21 kB

        Issue Links

          clones

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-5484 (7.1.0) There is not possibility to use alternative JSSE Cipher Suite Names for IBM JDK

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Verified
          is cloned by

          Bug - A problem that impairs or prevents the functions of the product. ELY-438 There is not possibility to use alternative JSSE Cipher Suite Names for IBM JDK

          • Blocker - To be worked above all other priorities. This term is chosen when the severity of the issue is very high, has no workaround, or the effort for the change is comparatively low. Issues that may be very publicly visible and could generate significant media attention may also drive a higher priority.
          • Resolved
          is incorporated by

          Component Upgrade - A task tracking an update to a bundled component or revision of component upstream of the project. JBEAP-5470 (7.0.z) Upgrade to WildFly Elytron 1.0.4.Final

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Verified
          relates to

          Bug - A problem that impairs or prevents the functions of the product. JBEAP-3382 (7.0.z) ELY-421 - Tests fail on IBM JDK with security manager

          • Major - To be worked after higher priority work items are addressed. When the severity is high and the effort to change it is low to moderate, this term is chosen. Issues in this category likely have an existing workaround but implementation or execution may be non-trivial.
          • Verified

          Activity

            People

              psotirop@redhat.com Panagiotis Sotiropoulos
              hsvabek_jira Hynek Švábek (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: