Added *_128_.* to the list of cipher suite patterns, and it made the difference...
Thanks, Sergey > > Hi > > Posting this question to a user list. > > When I launch a Firefox I have problems accessing my > HTTPS-enabled CXF server. > After Googling a bit, I enabled the following configuration > setting in Firefox after typing about:config in the address bar : > > security.ssl3.dhe_rsa_des_sha=true, which is disabled by > default...and then I managed to connect... > > My questions are : > > * in the ssl server policy, is there some property I can set > to use a suite different to ssl3.dhe_rsa_des_sha ? Have a look at the schema - common/schemas/src/main/resources/security.xsd. The server-side will generally support a range of ciphersuites, and the client will also have its own preferences, so the TLS handshake involves a negotiation as to which of these is used. You can either enumerate specific ciphersuites that you want to enable via the CipherSuites elements of SSLServerPolicy (for example the ciphersuites corresponding to the firefox config you enabled are probably "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA" and "SSL_RSA_WITH_DES_CBC_SHA"). Probably more convenient to include or exclude broad classes of ciphersuite via the CiphersuitesFilters element. See the hello_world_https demo for an example of setting this config. > * in the ssl server policy, TLSv1 is the default secure > protocol, should it be SSLv3 ? SSLv3 has been superseded by TLSv1, so I think its correct that the default is set to the latter. If you need it to be SSLv3 in your case, just make it so in config (SecureSocketProtocol element). Cheers, Eoghan
