Weblogic Mitigate POODLE vulnerability after upgrade and still use CBC ciphersApache Httpd and Weblogic configured for SSLPossible to close port 80 and still use port 443?How can I use SSL behind a load balancer and still get the client IP?LDAP over SSL with an EFI Fiery printerDisabled SSLv3 in Tomcat, but Still Showing POODLE VulnerabilitySSL 3 is still enabled after setting registry keys and rebooting Windows 2008 R2I use HPKP, my SSL certificate expired and after renewing my website is inaccessibleServer has “weak cipher setting” according to security audit, replaced offending cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA, but still failing retest audit?How to disable the DES and 3DES ciphers on Oracle WebLogic Server Node Manager Port(5556) in Red hat linux serverDisabling weak protocols and ciphers in Centos with Apache
Voltage Balun 1:1
Why didn't this character get a funeral at the end of Avengers: Endgame?
How can Internet speed be 10 times slower without a router than when using the same connection with a router?
Are pressure-treated posts that have been submerged for a few days ruined?
Can my 2 children, aged 10 and 12, who are US citizens, travel to the USA on expired American passports?
Dangerous workplace travelling
Does expanded replace the romannumeral trick for expansion?
Are the Night's Watch still required?
Why would a military not separate its forces into different branches?
Does "Captain Marvel" contain spoilers for "Avengers: Infinity War"?
SOQL query WHERE filter by specific months
Can there be a single technologically advanced nation, in a continent full of non-technologically advanced nations?
My first c++ game (snake console game)
Endgame puzzle: How to avoid stalemate and win?
What is the closest airport to the center of the city it serves?
Correct way of drawing empty, half-filled and fully filled circles?
Is there precedent or are there procedures for a US president refusing to concede to an electoral defeat?
Can you use "едать" and "игрывать" in the present and future tenses?
How does summation index shifting work?
As a GM, is it bad form to ask for a moment to think when improvising?
Dihedral group D4 composition with custom labels
Should I simplify my writing in a foreign country?
Handling Null values (and equivalents) routinely in Python
Is there a word that describes the unjustified use of a more complex word?
Weblogic Mitigate POODLE vulnerability after upgrade and still use CBC ciphers
Apache Httpd and Weblogic configured for SSLPossible to close port 80 and still use port 443?How can I use SSL behind a load balancer and still get the client IP?LDAP over SSL with an EFI Fiery printerDisabled SSLv3 in Tomcat, but Still Showing POODLE VulnerabilitySSL 3 is still enabled after setting registry keys and rebooting Windows 2008 R2I use HPKP, my SSL certificate expired and after renewing my website is inaccessibleServer has “weak cipher setting” according to security audit, replaced offending cipher TLS_RSA_WITH_3DES_EDE_CBC_SHA, but still failing retest audit?How to disable the DES and 3DES ciphers on Oracle WebLogic Server Node Manager Port(5556) in Red hat linux serverDisabling weak protocols and ciphers in Centos with Apache
.everyoneloves__top-leaderboard:empty,.everyoneloves__mid-leaderboard:empty,.everyoneloves__bot-mid-leaderboard:empty height:90px;width:728px;box-sizing:border-box;
I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible (supported by Weblogic, FF37, Chrome 44, etc) are as follows:
<ciphersuite>TLS_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
<ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
<ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
<ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA256</ciphersuite>
<ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</ciphersuite><ciphersuite>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
This is in config.xml under the ssl tag. I do have JSSE enabled as well to make sure I can get a TLS1.2 connection.
The supported cipherlist for Weblogic 10.3.6 found here
One issue that I see with SSL Labs is that with these ciphers, I am still possibly vulnerable to POODLE.
An Nmap scan gave me this for what the ciphers are:
| ssl-enum-ciphers:
| SSLv3:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.0:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.1:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
| compressors:
| NULL
|_ least strength: strong
Before TLS1.1 and TLS1.2 were enabled in setEnv.sh, I did not have this issue, so I am unsure why adding them changed what happened.
Now my question is how do I make sure that I have SSL3 disabled but still able to use some of the CBC ciphers? or have the support I need?
EDIT: I know that CBC ciphers are a no bueno kinda thing... I am open for suggestions for ciphers support TLS1.0+ and for a browser as low as IE 8.
ssl tls weblogic poodle
asked Apr 22 '15 at 14:46
VngeVnge
144211
add a comment |
I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible (supported by Weblogic, FF37, Chrome 44, etc) are as follows:
<ciphersuite>TLS_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
<ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
<ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
<ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA256</ciphersuite>
<ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</ciphersuite><ciphersuite>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
This is in config.xml under the ssl tag. I do have JSSE enabled as well to make sure I can get a TLS1.2 connection.
The supported cipherlist for Weblogic 10.3.6 found here
One issue that I see with SSL Labs is that with these ciphers, I am still possibly vulnerable to POODLE.
An Nmap scan gave me this for what the ciphers are:
| ssl-enum-ciphers:
| SSLv3:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.0:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.1:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
| compressors:
| NULL
|_ least strength: strong
Before TLS1.1 and TLS1.2 were enabled in setEnv.sh, I did not have this issue, so I am unsure why adding them changed what happened.
Now my question is how do I make sure that I have SSL3 disabled but still able to use some of the CBC ciphers? or have the support I need?
EDIT: I know that CBC ciphers are a no bueno kinda thing... I am open for suggestions for ciphers support TLS1.0+ and for a browser as low as IE 8.
ssl tls weblogic poodle
asked Apr 22 '15 at 14:46
VngeVnge
144211
add a comment |
I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible (supported by Weblogic, FF37, Chrome 44, etc) are as follows:
<ciphersuite>TLS_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
<ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
<ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
<ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA256</ciphersuite>
<ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</ciphersuite><ciphersuite>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
This is in config.xml under the ssl tag. I do have JSSE enabled as well to make sure I can get a TLS1.2 connection.
The supported cipherlist for Weblogic 10.3.6 found here
One issue that I see with SSL Labs is that with these ciphers, I am still possibly vulnerable to POODLE.
An Nmap scan gave me this for what the ciphers are:
| ssl-enum-ciphers:
| SSLv3:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.0:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.1:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
| compressors:
| NULL
|_ least strength: strong
Before TLS1.1 and TLS1.2 were enabled in setEnv.sh, I did not have this issue, so I am unsure why adding them changed what happened.
Now my question is how do I make sure that I have SSL3 disabled but still able to use some of the CBC ciphers? or have the support I need?
EDIT: I know that CBC ciphers are a no bueno kinda thing... I am open for suggestions for ciphers support TLS1.0+ and for a browser as low as IE 8.
ssl tls weblogic poodle
asked Apr 22 '15 at 14:46
VngeVnge
144211
I recently upgraded my Weblogic server to 10.3.6 with java 7. So with that I have TLS1.0 - TLS 1.2 enabled via the setEnv.sh. Some of the ciphers I am using to make sure that they are compatible (supported by Weblogic, FF37, Chrome 44, etc) are as follows:
<ciphersuite>TLS_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
<ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
<ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</ciphersuite>
<ciphersuite>TLS_RSA_WITH_AES_128_CBC_SHA256</ciphersuite>
<ciphersuite>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</ciphersuite><ciphersuite>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</ciphersuite>
This is in config.xml under the ssl tag. I do have JSSE enabled as well to make sure I can get a TLS1.2 connection.
The supported cipherlist for Weblogic 10.3.6 found here
One issue that I see with SSL Labs is that with these ciphers, I am still possibly vulnerable to POODLE.
An Nmap scan gave me this for what the ciphers are:
| ssl-enum-ciphers:
| SSLv3:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.0:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.1:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| compressors:
| NULL
| TLSv1.2:
| ciphers:
| TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 - strong
| TLS_RSA_WITH_3DES_EDE_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA - strong
| TLS_RSA_WITH_AES_128_CBC_SHA256 - strong
| compressors:
| NULL
|_ least strength: strong
Before TLS1.1 and TLS1.2 were enabled in setEnv.sh, I did not have this issue, so I am unsure why adding them changed what happened.
Now my question is how do I make sure that I have SSL3 disabled but still able to use some of the CBC ciphers? or have the support I need?
EDIT: I know that CBC ciphers are a no bueno kinda thing... I am open for suggestions for ciphers support TLS1.0+ and for a browser as low as IE 8.
ssl tls weblogic poodle
ssl tls weblogic poodle
asked Apr 22 '15 at 14:46
VngeVnge
144211
asked Apr 22 '15 at 14:46
VngeVnge
144211
edited Apr 22 '15 at 15:21
Vnge
asked Apr 22 '15 at 14:46
VngeVnge
144211
asked Apr 22 '15 at 14:46
VngeVnge
144211
asked Apr 22 '15 at 14:46
VngeVnge
144211
144211
add a comment |
add a comment |
2 Answers
2
active
oldest
votes
Just make sure that you use a higher version of Java than 7u75 (it disables them by default) then I think enabling TLS1.0 only can cause the downgrade for SSLv3 then you could use -Dweblogic.security.SSL.protocolVersion=TLS1 and TLS1.1. You should have disabled CBC a long time ago https://community.qualys.com/thread/9974. So you might have conflicting requirements.
answered Apr 22 '15 at 15:05
Alex HAlex H
1,713918
Okay, that would make sense. Would you have a suggestion for ciphers to support TLS 1.0+ for Weblogic?
– Vnge
Apr 22 '15 at 15:19
Assuming that you have most of the clients on Windows you can just pick them from here msdn.microsoft.com/en-us/library/windows/desktop/… . Make sure that whatever you chose it is supported by your client computers.
– Alex H
Apr 22 '15 at 15:34
So if CBC is not that great, why are there a large bunch of ciphers using it?
– Vnge
Apr 22 '15 at 15:35
That article is for Windows,an list of available options, and it has been made some time ago. Meanwhile some vulnerabilities have appeared :)
– Alex H
Apr 22 '15 at 15:37
Ah yes, gotcha.
– Vnge
Apr 22 '15 at 15:37
|
show 3 more comments
This is late to answer now, but can be used as future reference, if you are using Weblogic 10.3.6, which is compatible with JDK7. Recently Oracle released JDK 7u131 version which is supporting TLS1.1 and TLS1.2 by default. So you can upgrade JDK to 7u131.
edited Jun 14 '17 at 10:55
Esa Jokinen
23.9k23360
answered Jun 13 '17 at 21:01
AryaArya
163
add a comment |
Your Answer
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "2"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f684691%2fweblogic-mitigate-poodle-vulnerability-after-upgrade-and-still-use-cbc-ciphers%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
2 Answers
2
active
oldest
votes
2 Answers
2
active
oldest
votes
active
oldest
votes
active
oldest
votes
Just make sure that you use a higher version of Java than 7u75 (it disables them by default) then I think enabling TLS1.0 only can cause the downgrade for SSLv3 then you could use -Dweblogic.security.SSL.protocolVersion=TLS1 and TLS1.1. You should have disabled CBC a long time ago https://community.qualys.com/thread/9974. So you might have conflicting requirements.
answered Apr 22 '15 at 15:05
Alex HAlex H
1,713918
Okay, that would make sense. Would you have a suggestion for ciphers to support TLS 1.0+ for Weblogic?
– Vnge
Apr 22 '15 at 15:19
Assuming that you have most of the clients on Windows you can just pick them from here msdn.microsoft.com/en-us/library/windows/desktop/… . Make sure that whatever you chose it is supported by your client computers.
– Alex H
Apr 22 '15 at 15:34
So if CBC is not that great, why are there a large bunch of ciphers using it?
– Vnge
Apr 22 '15 at 15:35
That article is for Windows,an list of available options, and it has been made some time ago. Meanwhile some vulnerabilities have appeared :)
– Alex H
Apr 22 '15 at 15:37
Ah yes, gotcha.
– Vnge
Apr 22 '15 at 15:37
|
show 3 more comments
Just make sure that you use a higher version of Java than 7u75 (it disables them by default) then I think enabling TLS1.0 only can cause the downgrade for SSLv3 then you could use -Dweblogic.security.SSL.protocolVersion=TLS1 and TLS1.1. You should have disabled CBC a long time ago https://community.qualys.com/thread/9974. So you might have conflicting requirements.
answered Apr 22 '15 at 15:05
Alex HAlex H
1,713918
Okay, that would make sense. Would you have a suggestion for ciphers to support TLS 1.0+ for Weblogic?
– Vnge
Apr 22 '15 at 15:19
Assuming that you have most of the clients on Windows you can just pick them from here msdn.microsoft.com/en-us/library/windows/desktop/… . Make sure that whatever you chose it is supported by your client computers.
– Alex H
Apr 22 '15 at 15:34
So if CBC is not that great, why are there a large bunch of ciphers using it?
– Vnge
Apr 22 '15 at 15:35
That article is for Windows,an list of available options, and it has been made some time ago. Meanwhile some vulnerabilities have appeared :)
– Alex H
Apr 22 '15 at 15:37
Ah yes, gotcha.
– Vnge
Apr 22 '15 at 15:37
|
show 3 more comments
Just make sure that you use a higher version of Java than 7u75 (it disables them by default) then I think enabling TLS1.0 only can cause the downgrade for SSLv3 then you could use -Dweblogic.security.SSL.protocolVersion=TLS1 and TLS1.1. You should have disabled CBC a long time ago https://community.qualys.com/thread/9974. So you might have conflicting requirements.
answered Apr 22 '15 at 15:05
Alex HAlex H
1,713918
Just make sure that you use a higher version of Java than 7u75 (it disables them by default) then I think enabling TLS1.0 only can cause the downgrade for SSLv3 then you could use -Dweblogic.security.SSL.protocolVersion=TLS1 and TLS1.1. You should have disabled CBC a long time ago https://community.qualys.com/thread/9974. So you might have conflicting requirements.
answered Apr 22 '15 at 15:05
Alex HAlex H
1,713918
answered Apr 22 '15 at 15:05
Alex HAlex H
1,713918
answered Apr 22 '15 at 15:05
Alex HAlex H
1,713918
answered Apr 22 '15 at 15:05
Alex HAlex H
1,713918
1,713918
Okay, that would make sense. Would you have a suggestion for ciphers to support TLS 1.0+ for Weblogic?
– Vnge
Apr 22 '15 at 15:19
Assuming that you have most of the clients on Windows you can just pick them from here msdn.microsoft.com/en-us/library/windows/desktop/… . Make sure that whatever you chose it is supported by your client computers.
– Alex H
Apr 22 '15 at 15:34
So if CBC is not that great, why are there a large bunch of ciphers using it?
– Vnge
Apr 22 '15 at 15:35
That article is for Windows,an list of available options, and it has been made some time ago. Meanwhile some vulnerabilities have appeared :)
– Alex H
Apr 22 '15 at 15:37
Ah yes, gotcha.
– Vnge
Apr 22 '15 at 15:37
|
show 3 more comments
Okay, that would make sense. Would you have a suggestion for ciphers to support TLS 1.0+ for Weblogic?
– Vnge
Apr 22 '15 at 15:19
Assuming that you have most of the clients on Windows you can just pick them from here msdn.microsoft.com/en-us/library/windows/desktop/… . Make sure that whatever you chose it is supported by your client computers.
– Alex H
Apr 22 '15 at 15:34
So if CBC is not that great, why are there a large bunch of ciphers using it?
– Vnge
Apr 22 '15 at 15:35
That article is for Windows,an list of available options, and it has been made some time ago. Meanwhile some vulnerabilities have appeared :)
– Alex H
Apr 22 '15 at 15:37
Ah yes, gotcha.
– Vnge
Apr 22 '15 at 15:37
Okay, that would make sense. Would you have a suggestion for ciphers to support TLS 1.0+ for Weblogic?
– Vnge
Apr 22 '15 at 15:19
Okay, that would make sense. Would you have a suggestion for ciphers to support TLS 1.0+ for Weblogic?
– Vnge
Apr 22 '15 at 15:19
Assuming that you have most of the clients on Windows you can just pick them from here msdn.microsoft.com/en-us/library/windows/desktop/… . Make sure that whatever you chose it is supported by your client computers.
– Alex H
Apr 22 '15 at 15:34
Assuming that you have most of the clients on Windows you can just pick them from here msdn.microsoft.com/en-us/library/windows/desktop/… . Make sure that whatever you chose it is supported by your client computers.
– Alex H
Apr 22 '15 at 15:34
So if CBC is not that great, why are there a large bunch of ciphers using it?
– Vnge
Apr 22 '15 at 15:35
So if CBC is not that great, why are there a large bunch of ciphers using it?
– Vnge
Apr 22 '15 at 15:35
That article is for Windows,an list of available options, and it has been made some time ago. Meanwhile some vulnerabilities have appeared :)
– Alex H
Apr 22 '15 at 15:37
That article is for Windows,an list of available options, and it has been made some time ago. Meanwhile some vulnerabilities have appeared :)
– Alex H
Apr 22 '15 at 15:37
Ah yes, gotcha.
– Vnge
Apr 22 '15 at 15:37
Ah yes, gotcha.
– Vnge
Apr 22 '15 at 15:37
|
show 3 more comments
This is late to answer now, but can be used as future reference, if you are using Weblogic 10.3.6, which is compatible with JDK7. Recently Oracle released JDK 7u131 version which is supporting TLS1.1 and TLS1.2 by default. So you can upgrade JDK to 7u131.
edited Jun 14 '17 at 10:55
Esa Jokinen
23.9k23360
answered Jun 13 '17 at 21:01
AryaArya
163
add a comment |
This is late to answer now, but can be used as future reference, if you are using Weblogic 10.3.6, which is compatible with JDK7. Recently Oracle released JDK 7u131 version which is supporting TLS1.1 and TLS1.2 by default. So you can upgrade JDK to 7u131.
edited Jun 14 '17 at 10:55
Esa Jokinen
23.9k23360
answered Jun 13 '17 at 21:01
AryaArya
163
add a comment |
This is late to answer now, but can be used as future reference, if you are using Weblogic 10.3.6, which is compatible with JDK7. Recently Oracle released JDK 7u131 version which is supporting TLS1.1 and TLS1.2 by default. So you can upgrade JDK to 7u131.
edited Jun 14 '17 at 10:55
Esa Jokinen
23.9k23360
answered Jun 13 '17 at 21:01
AryaArya
163
This is late to answer now, but can be used as future reference, if you are using Weblogic 10.3.6, which is compatible with JDK7. Recently Oracle released JDK 7u131 version which is supporting TLS1.1 and TLS1.2 by default. So you can upgrade JDK to 7u131.
edited Jun 14 '17 at 10:55
Esa Jokinen
23.9k23360
answered Jun 13 '17 at 21:01
AryaArya
163
edited Jun 14 '17 at 10:55
Esa Jokinen
23.9k23360
edited Jun 14 '17 at 10:55
Esa Jokinen
23.9k23360
edited Jun 14 '17 at 10:55
Esa Jokinen
23.9k23360
23.9k23360
answered Jun 13 '17 at 21:01
AryaArya
163
answered Jun 13 '17 at 21:01
AryaArya
163
answered Jun 13 '17 at 21:01
AryaArya
163
163
add a comment |
add a comment |
Thanks for contributing an answer to Server Fault!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fserverfault.com%2fquestions%2f684691%2fweblogic-mitigate-poodle-vulnerability-after-upgrade-and-still-use-cbc-ciphers%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
