<p><span style="font-size:18px">现在网络安全原来越重要，好多公司网站需要ssl支持，也就是要求客户通过https访问公司站点，由于TLSv1.1容易被黑客攻击，于是很多企业要求站点只提供TLSv1.2协议支持。</span></p>
<p><span style="font-size:18px">对Java 程序，TLSv1.2的实现中， oracle 从JDK1.7 update96以后的版本才开始支持，IBM JDK 采用的是类似的方案。只有从JDK1.8开始才是默认支持的。</span></p>
<p><span style="font-size:18px">https://bugs.openjdk.java.net/browse/JDK-7093640<br> </span></p>
<p><span style="font-size:18px">https://www.java.com/en/configure_crypto.html#enableTLSv1_2<br> </span></p>
<p><span style="font-size:18px">https://wiki.openssl.org/index.php/Manual:Ciphers(1) 参见TLSv1.2支持的cipher list.<br> </span></p>
<p><span style="font-size:18px">TLSv1.2协议支持具体要分三部分内容。</span></p>
<p><span style="font-size:18px"><一>服务器对TLSv1.2的支持。</span></p>
<p><span style="font-size:18px">具体要看服务器采用的是那种服务器，这里主要讲Apache web server 和Tomcat 为基础的web 服务器。</span></p>
<p><span style="font-size:18px"></span></p>
<p>Apache web server:</p>
<p><strong>更新文件 httpd-ssl.conf于如下路径：WebServer/conf/extra/</strong></p>
<p><br> </p>
<p><span style="font-size:18px">做如下更改： </span></p>
<p><span style="font-size:18px"><span style="color:rgb(51,51,51)">#Limit Protocol to TLSv1.2</span><span style="color:#333333"><br> SSLProtocol +TLSv1.2</span><br> <br> #Update cipher suites to remediate variousencryption related vulnerabilities<br> SSLHonorCipherOrder On<br> SSLCipherSuiteECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256</span></p>
<p><span style="color:rgb(51,51,51)"><span style="font-size:18px"> </span></span></p>
<p><span style="color:rgb(51,51,51)"><span style="font-size:18px">Tomcat:</span></span></p>
<p><span style="font-size:18px"><span style="color:rgb(51,51,51)"> 更新文件</span><span style="color:rgb(51,51,51)"> </span><span style="color:rgb(51,51,51)"><em>wrapper.conf</em></span><span style="color:rgb(51,51,51)"> 文件于如下路径</span></span></p>
<p><span style="font-size:18px"><strong><span style="color:rgb(51,51,51)"> Tomcat/conf/</span></strong><span style="color:rgb(51,51,51)"> (Windows) or the setenv.shscript file (UNIX) with the following modifications:</span></span></p>
<p><span style="font-size:18px"><span style="color:rgb(51,51,51)"> </span><span style="color:rgb(51,51,51)">· 添加参数</span><span style="color:rgb(51,51,51)"> -Djdk.tls.client.protocols=TLSv1.2 在 Java Virtual Machine (JVM) arguments.</span></span></p>
<p><span style="font-size:18px"><span style="color:rgb(51,51,51)">针对AIX 环境参数变为</span><span style="color:rgb(51,51,51)">-Dcom.ibm.jsse2.overrideDefaultProtocol="TLSv12".</span></span></p>
<p><span style="font-size:18px"><span style="color:#333333">· 如果Tomcat 配置了</span><span style="color:rgb(51,51,51)">TLS , 更新文件 server.xml 在如下路径</span></span></p>
<p><span style="font-size:18px"><strong><span style="color:rgb(51,51,51)">Tomcat/conf/</span></strong><span style="color:rgb(51,51,51)">, 如下. 在<Connector> 定义中, 更改 ciphers 和 sslProtocols 参数如下:</span></span></p>
<p><span style="color:rgb(51,51,51)"><span style="font-size:18px">ciphers="TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_RSA_WITH_AES_256_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA" sslProtocols="TLSv1.2"</span></span></p>
<p><br> </p>
<p><span style="font-size:18px"><二>客户端设置对TLSv1.2的支持</span></p>
<p><span style="color:rgb(51,51,51); font-family:Arial,sans-serif"><span style="font-size:18px">现代浏览器对TLS 1.2 默认支持的版本如下: </span></span><br style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> <span style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> </span><br style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> <span style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> Firefox: Next 6 months (either version 27 or 28) </span><br style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> <span style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> IE version 11 </span><br style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> <span style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> Google Chrome 31 </span><br style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> <span style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> Opera 18 on Windows </span><br style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> <span style="color:rgb(51,51,51); font-family:Arial,sans-serif; font-size:14px"> Safari 7.0 on Mac </span><br> <span style="font-family:Arial; font-size:14px"></span> |
|
转播
