eclipse-vertx / eclipse-vertx/vert.x
Support filtering of insecure CipherSuits when using TLS
- Dominant language
- Java
- Stars
- 14.7k
- Forks
- 2.1k
- Avg merge
- 2d 7h
- Merged PRs (30d)
- 28
Description
In order to remove insecure cipher suits from secure TLS versions.
e.g. TLS 1.2 is required [rfc5246](https://datatracker.ietf.org/doc/html/rfc5246#appendix-A.5) to support TLS_RSA_WITH_AES_128_CBC_SHA however and other are vulnirable to the [Lucky13](http://www.isg.rhul.ac.uk/tls/Lucky13.html) attack and should be removed by the user.
Netty the underlying transport for VertX supports this via [io.netty.handler.ssl.CipherSuiteFilter](https://github.com/netty/netty/blob/07cc3fd57993ac3d7b18375e1bd453dfbdb2b27d/handler/src/main/java/io/netty/handler/ssl/CipherSuiteFilter.java)
This needs to be exposed to VertX so insecure ciphers can be removed.
This was discussed in #1507 but a solution was not proposed.
Contributor guide
Assessment
This issue has not been assessed yet.