A new SSL option to allow overriding default cipher suites. #61
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Thanks. Can you please update |
|
@arr-ee FYI. |
juhani-hietikko
force-pushed
the
cipher-suites-as-ssl-option
branch
from
1817e3d to
8a35118
Compare
|
Thanks for the quick response! Yeah, I missed the changelog in the first place. As you can see, I'm working on it but something with the markup needs fixing. I'm amending to the same commit, so apparently the PR gets automatically updated when I push. I'll push a new fix to the changelog soon. |
juhani-hietikko
force-pushed
the
cipher-suites-as-ssl-option
branch
from
8a35118 to
293b00a
Compare
|
How does the changelog look like now? Anything else? I see the CI build is failing, but it seems to be flaky. |
michaelklishin
added a commit
that referenced
this pull request
Aug 27, 2014
A new SSL option to allow overriding default cipher suites.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
I've added an option to specify SSL cipher suites when calling build-cluster.
Datastax Java driver's default cipher suites (SSLOptions/DEFAULT_SSL_CIPHER_SUITES) require installing the Java Cryptography Extension Unlimited Strength Jurisdiction Policy Files. Without installing these, connecting to a cluster with SSL fails:
"java.lang.IllegalArgumentException: Cannot support TLS_RSA_WITH_AES_256_CBC_SHA with currently installed providers"
One way to work around this is by specifying cipher suites that work with standard JCE in the SSLOptions given to the Java driver's Cluster builder. That is the motive for this change.
:cipher-suites is expected to contain a Seq (e.g. vector) of Strings, where each item specifies a cipher suite (e.g. "TLS_RSA_WITH_AES_128_CBC_SHA"). When the :cipher-suites option is omitted, build-ssl-options and build-cluster work as before, using default cipher suites from SSLOptions.