Added support for disabling SSL ciphers in pki.conf.

The CryptoUtil.setSSLCiphers() has been modified to support a "-"
sign in front of the cipher name or ID to disable the cipher.

1 files changed, 8 insertions, 1 deletions

diff --git a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
index 5e6659363..c436b4d02 100644
--- a/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
+++ b/base/util/src/com/netscape/cmsutil/crypto/CryptoUtil.java
@@ -955,7 +955,14 @@ public class CryptoUtil {
 
         while (st.hasMoreTokens()) {
             String cipher = st.nextToken();
-            setSSLCipher(cipher, true);
+            boolean enabled = true;
+
+            if (cipher.startsWith("-")) {
+                enabled = false;
+                cipher = cipher.substring(1);
+            }
+
+            setSSLCipher(cipher, enabled);
         }
     }