diff options
| author | Endi S. Dewata <edewata@redhat.com> | 2017-03-17 19:20:30 +0100 |
|---|---|---|
| committer | Endi S. Dewata <edewata@redhat.com> | 2017-03-19 19:31:21 +0100 |
| commit | 31683301b69fda23893c80af7c34c42a75e1b906 (patch) | |
| tree | 77a3a3bc3f00d6b7d07c71e83441d5ba976f103e /base/java-tools/src/com | |
| parent | 6bcb89b55db870766ddcf09002a5997b323bd196 (diff) | |
| download | pki-31683301b69fda23893c80af7c34c42a75e1b906.tar.gz pki-31683301b69fda23893c80af7c34c42a75e1b906.tar.xz pki-31683301b69fda23893c80af7c34c42a75e1b906.zip | |
Added configuration parameters for SSL version ranges.
The hard-coded SSL version ranges in PKI CLI have been converted
into configurable parameters in the pki.conf.
Diffstat (limited to 'base/java-tools/src/com')
| -rw-r--r-- | base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java | 20 |
1 files changed, 18 insertions, 2 deletions
diff --git a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java index 8f575dbf7..b3de8757f 100644 --- a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java @@ -519,8 +519,24 @@ public class MainCLI extends CLI { } - CryptoUtil.setSSLStreamVersionRange(SSLVersion.TLS_1_0, SSLVersion.TLS_1_2); - CryptoUtil.setSSLDatagramVersionRange(SSLVersion.TLS_1_1, SSLVersion.TLS_1_2); + // See default SSL configuration in /usr/share/pki/etc/pki.conf. + + String streamVersionMin = System.getenv("SSL_STREAM_VERSION_MIN"); + String streamVersionMax = System.getenv("SSL_STREAM_VERSION_MAX"); + + CryptoUtil.setSSLStreamVersionRange( + SSLVersion.valueOf(streamVersionMin), + SSLVersion.valueOf(streamVersionMax) + ); + + String datagramVersionMin = System.getenv("SSL_DATAGRAM_VERSION_MIN"); + String datagramVersionMax = System.getenv("SSL_DATAGRAM_VERSION_MAX"); + + CryptoUtil.setSSLDatagramVersionRange( + SSLVersion.valueOf(datagramVersionMin), + SSLVersion.valueOf(datagramVersionMax) + ); + CryptoUtil.setClientCiphers(); } |