java - 使用 javax.net.ssl.SSLContext 时禁用弱 ssl 密码

Question

我使用 javax.net.ssl.SSLContext 类实现安全连接，代码：

        ...
        SSLContext sslcontext = SSLContext.getInstance("TLS");
        sslcontext.init(null, trustManager, null);
        SSLSocketFactory sf = new SSLSocketFactory(sslcontext);
        ...

我想禁用弱 ssl 密码。怎么做？

Answer 1

Have you looked at the JavaDoc for SSLSocketFactory? I paraphrase

...Normally, only a subset of these will actually be enabled by default, since this list may include cipher suites which do not meet quality of service requirements...

In other words, you probably shouldn't worry, but if you do, you can explicitly supply your own implementation/extension of the default impl of SSLSocketFactory and override said method, or simply set the cipher suites you want enabled on your SSLSocket.

Cheers,

Answer 2

他们已经被禁用。如果要禁用更多密码套件，请使用SSLSocket.setEnabledCipherSuites().

Answer 3

您可以使用3rd 方 SSLContext 构建器，它允许您为密码指定白名单和黑名单。