Merge pull request #801 from JinhangZhang/disablemoredheciphersuites

Disable more DHE related ciphersuites
ibmruntimes · Aug 12, 2024 · 03f8cc5 · 03f8cc5
2 parents 81ade32 + f51f329
commit 03f8cc5
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/src/java.base/share/conf/security/java.security b/src/java.base/share/conf/security/java.security
@@ -188,7 +188,7 @@ RestrictedSecurity.NSS.140-2.securerandom.algorithm = PKCS11
 RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.name = OpenJCEPlusFIPS Cryptographic Module FIPS 140-3
 RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.default = false
 RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.fips = true
-RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.hash = SHA256:b3e01416cda6ca0134e92940b1c2d94664a742325cbbc8d65b6f536ea3770853
+RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.hash = SHA256:a5bd1607d552ad08e8d3372bceaedb759a68a48ed8d3840abc1992615a814447
 RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.number = Certificate #XXX
 RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.policy = https://csrc.nist.gov/projects/cryptographic-module-validation-program/certificate/
 RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.desc.sunsetDate = 2026-09-21
@@ -213,7 +213,11 @@ RestrictedSecurity.OpenJCEPlusFIPS.FIPS140-3.tls.disabledAlgorithms = \
  TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, \
  TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, \
  TLS_DHE_RSA_WITH_AES_128_CBC_SHA, \
+ TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, \
+ TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, \
  TLS_DHE_RSA_WITH_AES_256_CBC_SHA, \
+ TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, \
+ TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, \
  TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, \
  TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, \
  TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, \