Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fully remove SSL_ and SSL3_ ciphersuites #638

Open
cipherboy opened this issue Oct 5, 2020 · 0 comments
Open

Fully remove SSL_ and SSL3_ ciphersuites #638

cipherboy opened this issue Oct 5, 2020 · 0 comments
Labels
Bug Something isn't working minor Changes which fix minor bugs

Comments

@cipherboy
Copy link
Member

We include the following (deprecated) ciphersuites:

/home/ascheel/GitHub/cipherboy/jss/src/main/java/org/mozilla/jss/ssl/SSLClient.java:375: warning: [deprecation] SSL3_RSA_WITH_RC4_128_MD5 in SSLSocket has been deprecated
    SSLSocket.SSL3_RSA_WITH_RC4_128_MD5,
             ^
/home/ascheel/GitHub/cipherboy/jss/src/main/java/org/mozilla/jss/ssl/SSLClient.java:376: warning: [deprecation] SSL3_RSA_WITH_3DES_EDE_CBC_SHA in SSLSocket has been deprecated
    SSLSocket.SSL3_RSA_WITH_3DES_EDE_CBC_SHA,
             ^
/home/ascheel/GitHub/cipherboy/jss/src/main/java/org/mozilla/jss/ssl/SSLClient.java:377: warning: [deprecation] SSL3_RSA_WITH_DES_CBC_SHA in SSLSocket has been deprecated
    SSLSocket.SSL3_RSA_WITH_DES_CBC_SHA,
             ^
/home/ascheel/GitHub/cipherboy/jss/src/main/java/org/mozilla/jss/ssl/SSLClient.java:380: warning: [deprecation] SSL3_RSA_WITH_NULL_MD5 in SSLSocket has been deprecated
    SSLSocket.SSL3_RSA_WITH_NULL_MD5,
             ^
/home/ascheel/GitHub/cipherboy/jss/src/main/java/org/mozilla/jss/ssl/SSLServer.java:255: warning: [deprecation] SSL3_RSA_WITH_RC4_128_MD5 in SSLSocket has been deprecated
    	SSLSocket.SSL3_RSA_WITH_RC4_128_MD5,
    	         ^
/home/ascheel/GitHub/cipherboy/jss/src/main/java/org/mozilla/jss/ssl/SSLServer.java:256: warning: [deprecation] SSL3_RSA_WITH_3DES_EDE_CBC_SHA in SSLSocket has been deprecated
	SSLSocket.SSL3_RSA_WITH_3DES_EDE_CBC_SHA,
	         ^
/home/ascheel/GitHub/cipherboy/jss/src/main/java/org/mozilla/jss/ssl/SSLServer.java:257: warning: [deprecation] SSL3_RSA_WITH_DES_CBC_SHA in SSLSocket has been deprecated
	SSLSocket.SSL3_RSA_WITH_DES_CBC_SHA,
	         ^
/home/ascheel/GitHub/cipherboy/jss/src/main/java/org/mozilla/jss/ssl/SSLServer.java:260: warning: [deprecation] SSL3_RSA_WITH_NULL_MD5 in SSLSocket has been deprecated
	SSLSocket.SSL3_RSA_WITH_NULL_MD5,
	         ^

We should either remove them entirely (as they are insecure) or we should switch to using the TLS_ equivalent versions of these constants internally and remove the SSL3_ deprecation warnings.

@cipherboy cipherboy added Bug Something isn't working minor Changes which fix minor bugs labels Oct 5, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Bug Something isn't working minor Changes which fix minor bugs
Projects
None yet
Development

No branches or pull requests

1 participant