Re: Java 8 apparently not honoring overrides to java.security

On 8/12/20 8:40 AM, Charles Wilt wrote:

Sounds like the newer versions may have dropped triple DES...

I looked around for release notes, but I didn't find confirmation.

Now, I'm back on this problem, that still hasn't been resolved.

To refresh everybody's memory, when calling the https://maps.googleapis.com/maps/api/geocode web service, from a Tomcat webapp running under Java 8 on several customer Midrange boxes, I get:

Unable to find acceptable protocols. isFallback=false,
modes=[ConnectionSpec(cipherSuites=[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_3DES_EDE_CBC_SHA], tlsVersions=[TLS_1_2, TLS_1_1,
TLS_1_0], supportsTlsExtensions=true),
ConnectionSpec(cipherSuites=[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA,
TLS_RSA_WITH_3DES_EDE_CBC_SHA], tlsVersions=[TLS_1_0],
supportsTlsExtensions=true), ConnectionSpec()], supported
protocols=[TLSv1]

In the past, removing DESede from jdk.tls.disabledAlgorithms solved the problem, either in the JVM's own java.security ("the sledghehammer approach") or in an override file pulled in with a -Djava.security.properties in JAVA_OPTS.

A month ago, we tried the security override, and it failed to work. This morning, I tried the "sledgehammer" approach on one of them, and it *did* work.

It appears that Mr. Wilt was right. Does anybody have any suggestions of how to deal with this? How to find common ground between what the JVM can do and what Google can do?

Incidentally, I tried the suggestion from Colin Williams (on the Java400 List) to add "-Djavax.net.debug=ssl:handshake" It took several tries to get anything out of it, but I just got something very big. I've downloaded a local copy of it.

--
JHHL