From d06e291b25087dfd4cd70e6f97e2c0f4f84bd121 Mon Sep 17 00:00:00 2001 From: "Endi S. Dewata" Date: Fri, 17 Mar 2017 09:11:52 +0100 Subject: Moved default SSL configuration out of PKIConnection. To prevent conflicts, the code that configures the default SSL version ranges and ciphers for all SSL sockets created afterwards has been moved out of PKIConnection into the main program (i.e. PKI CLI). --- base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'base/java-tools/src') diff --git a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java index 75904edc6..4c0a91823 100644 --- a/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java +++ b/base/java-tools/src/com/netscape/cmstools/cli/MainCLI.java @@ -59,6 +59,7 @@ import com.netscape.cmstools.pkcs12.PKCS12CLI; import com.netscape.cmstools.system.SecurityDomainCLI; import com.netscape.cmstools.user.UserCLI; import com.netscape.cmsutil.crypto.CryptoUtil; +import com.netscape.cmsutil.crypto.CryptoUtil.SSLVersion; /** * @author Endi S. Dewata @@ -518,6 +519,10 @@ public class MainCLI extends CLI { } + CryptoUtil.setSSLStreamVersionRange(SSLVersion.TLS_1_0, SSLVersion.TLS_1_2); + CryptoUtil.setSSLDatagramVersionRange(SSLVersion.TLS_1_1, SSLVersion.TLS_1_2); + CryptoUtil.setClientCiphers(); + client = new PKIClient(config, null); client.setVerbose(verbose); -- cgit