13 Replies Latest reply on Feb 19, 2020 1:47 AM by dcook-1

How to disable SSLv3

spackiaraj Dec 16, 2014 1:02 PM

How to disable SSLv3 in Wildfly 8.0. Following configuration

<server-identities>
 <ssl protocol="TLSv1"> 
 <keystore path="https.keystore" relative-to="keystore.home" keystore-password="secret" alias="https" key-password="secret" /> 
 </ssl> 
</server-identities>

falls back to SSLv3, if SSLv3 requested. Is there any way I can allow only "TLSv1, TLSv1.1, TLSv1.2".

This setting is mandatory for us to fix POODLE vulnerability

1. Re: How to disable SSLv3

ctomc Dec 16, 2014 3:34 PM (in response to spackiaraj)

that is configured on https-listener in undertow subsystem

add this to <https-listener> element enabled-protocols="TLSv1, TLSv1.1, TLSv1.2"
1 of 1 people found this helpful
Actions
2. Re: How to disable SSLv3

zcc39r Dec 17, 2014 2:35 AM (in response to ctomc)

enabled-protocols="TLSv1, TLSv1.1, TLSv1.2"

Indeed, this configuration disables SSLv3.But TLSv1.1 and TLSv1.2 become disabled too. TLSv1 is available only. WildFly-8.1.0-Final. What's wrong?
Actions
3. Re: How to disable SSLv3

ctomc Dec 17, 2014 8:56 AM (in response to ctomc)

ctomc wrote:

that is configured on https-listener in undertow subsystem

add this to <https-listener> element enabled-protocols="TLSv1, TLSv1.1, TLSv1.2"

That is strange, as TLS 1.1 & 1.2 should be in JDK7. Maybe some problem with jdk?
What exact jdk are you using as this is relevant in this case.
Also can you try with wildfly 8.1 or newer as in 8.0 default security provider for SSL (in most cases at least) was bouncy castle and it might have caused this.
Actions
4. Re: How to disable SSLv3

zcc39r Dec 17, 2014 10:52 AM (in response to ctomc)

Maybe some problem with jdk?

What exact jdk are you using as this is relevant in this case.

No JDK at all. Just JRE 1.8.0_25. Tried JRE 1.7.0_71 with the same result - TLSv1.1 and TLSv1.2 disabled.

Also can you try with wildfly 8.1

WildFly-8.1.0-Final as I told in my previous message.
Actions
5. Re: How to disable SSLv3

ctomc Dec 17, 2014 10:56 AM (in response to zcc39r)

that looks strange, can you try something.
configure it without spaces in between, like this: enabled-protocols="TLSv1,TLSv1.1,TLSv1.2"
looking at the code it could be a problem.
Actions
6. Re: How to disable SSLv3

zcc39r Dec 17, 2014 11:20 AM (in response to ctomc)

configure it without spaces in between

Yes, it was helpful! Now all three TLS versions are available.
Actions
7. Re: How to disable SSLv3

ctomc Dec 17, 2014 11:37 AM (in response to zcc39r)

I will send fix for this shortly.
Actions
8. Re: How to disable SSLv3

ctomc Dec 18, 2014 6:01 AM (in response to ctomc)

this is the fix Trim elements in sequence options by ctomc · Pull Request #409 · wildfly/wildfly-core · GitHub
Actions
9. Re: How to disable SSLv3

surfrider Jan 19, 2015 4:49 AM (in response to ctomc)

>> enabled-protocols="TLSv1, TLSv1.1, TLSv1.2"

I have a project running on Wildfly 8.0 (don't want to move to 8.1 )
Wilfy 8.0 uses undertow 1.0. The "enabled-protocols" attribute is added in undertow 1.1 (included in Wildfly 8.1.)

How do I disable SSL in Wildfly 8.0?
Actions
10. Re: How to disable SSLv3

ctomc Jan 19, 2015 7:52 AM (in response to surfrider)

Robert de Leeuw wrote:

>> enabled-protocols="TLSv1, TLSv1.1, TLSv1.2"

I have a project running on Wildfly 8.0 (don't want to move to 8.1 )

Wilfy 8.0 uses undertow 1.0. The "enabled-protocols" attribute is added in undertow 1.1 (included in Wildfly 8.1.)

How do I disable SSL in Wildfly 8.0?

By upgrading to 8.1, 8.2 or 9 ...
Actions
11. Re: How to disable SSLv3

jasonholmberg Mar 9, 2016 3:38 PM (in response to spackiaraj)

Will this also handle the recent DROWN vulnerability?
Actions
12. Re: How to disable SSLv3

mchoma Mar 10, 2016 4:41 AM (in response to jasonholmberg)

AFAIK, SSLv2 is not supported by java 8 (which is mandatory for wildfly). So DROWN doesn't impact wildfly directly. You can explicitly enable only TLS protocols to be sure

But still you are vulnerable to DROWN if wildfly share private key with another server, which enables SSLv2.
Actions
13. Re: How to disable SSLv3

dcook-1 Feb 19, 2020 1:47 AM (in response to ctomc)

Sorry to respond to an old forum post.

I was curious if there were an option for "disabled-protocols" as an alternative to "enabled-protocols". I was recently debating (with myself) about whitelists vs blacklists in terms of maintainability and future proofing. I suppose a blacklist could get unwieldy over time but a whitelist could prevent newer protocols being used as they come out.

Based on the following, I'm guessing there is no "disabled-protocols". I'm not a frequent Wildfly user or developer, so I'm unlikely to send in a pull request, but perhaps there is somewhere else for feature requests?
wildfly-core/wildfly-config_4_0.xsd at master · wildfly/wildfly-core · GitHub
Actions

Go to original post