This issue is being created early to provide an early heads up that documentation changes will be needed for this feature.
Feature epic details
Operating systems
Does the documentation apply to all operating systems?
Summary
We will remove 'securityLevel' attribute from our ssl configuration.
in place of securityLevel we do two things
- Use the JDK effective tls cipher suites
- The enabledCiphers attribute will include a new syntax to add
+ or remove – specific ciphers from the JDK default list without redefining everything. This syntax update is mutually exclusive to the previous usage. Meaning users can either provide a static list of cipher suites OR provide a list of cipher suites with + / - prepended to them. They cannot have both.
Configuration
updated property enabledCiphers
remove property securityLevel
Previous configuration (no longer applicable):
<ssl id="defaultSSL" securityLevel="CUSTOM" enabledCiphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"/>
Updated configuration:
Old syntax is stan example of new syntax with wildcard
<ssl id="enabledCiphers="TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"/>
OR
<ssl id="enabledCiphers="-TLS_ECDHE_* +TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"/>
Updates to existing topics
update:
enabledCiphers with description
Specifies a custom list of ciphers. Separate each cipher in the list with a space. The supported cipher will depend on the underlying JRE used. Please check the JRE for valid ciphers.
OR
Specifies filter criteria to add (+) or remove (-) cipher suites from the JDK effective TLS cipher suites.
To add a cipher, prefix its full suite name with +.
To remove a cipher, prefix its full suite name with -.
You may also use the * wildcard to remove multiple cipher suites with '-'. When used, * must appear only at the end of the list item, and all cipher suites matching the prefix before the * will be removed. The wildcard cannot be used when adding cipher suites.
Users may not specify the static custom list and filter criteria.
This issue is being created early to provide an early heads up that documentation changes will be needed for this feature.
Feature epic details
Operating systems
Does the documentation apply to all operating systems?
Summary
We will remove 'securityLevel' attribute from our ssl configuration.
in place of securityLevel we do two things
+or remove–specific ciphers from the JDK default list without redefining everything. This syntax update is mutually exclusive to the previous usage. Meaning users can either provide a static list of cipher suites OR provide a list of cipher suites with + / - prepended to them. They cannot have both.Configuration
updated property
enabledCiphersremove property
securityLevelPrevious configuration (no longer applicable):
Updated configuration:
Old syntax is stan example of new syntax with wildcard
OR
Updates to existing topics
public static String[] adjustSupportedCiphers(String[] supportedCiphers, String enabledCiphers)Remove:
update:
enabledCipherswith description