I'm running into a bit of a pickle with a call to a third-party API from a java application. The external API requires at least one of the following ciphers:
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
I followed the instructions here: https://confluence.atlassian.com/stashkb/list-ciphers-used-by-jvm-679609085.html to try to upgrade the available ciphers on my application server. After the upgrade however I still don't see any of the compatible ciphers listed.
I suspect the problem is that my server is running jdk 1.7 . This is a legacy application so unfortunately I'm not able to upgrade to a newer jdk. Is there any way to add those ciphers to my existing java installation?
Update: I figured out how to add additional ciphers but it doesn't seem to have helped. In my socket factory I added some code like this:
private Socket acceptOnlyTLS12(Socket socket) {
if (!(socket instanceof SSLSocket))
return socket;
SSLSocket sslSocket = (SSLSocket) socket;
sslSocket.setEnabledProtocols(new String[] { "TLSv1.2" });
List<String> ciphers = new ArrayList<String>(Arrays.asList(sslSocket.getEnabledCipherSuites()));
ciphers.add("TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256");
sslSocket.setEnabledCipherSuites(ciphers.toArray(new String[] {}));
return sslSocket;
}
Is there another step I'm missing somewhere? Is some way to obtain additional information about why the ssl handshake is failing?