JDK-8167459 : Add debug output for indicating if a chosen ciphersuite was legacy
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 9
  • Priority: P2
  • Status: Closed
  • Resolution: Fixed
  • Submitted: 2016-10-10
  • Updated: 2017-11-29
  • Resolved: 2016-10-11
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 6 JDK 7 JDK 8 JDK 9 Other
6u141Fixed 7u131Fixed 8u121Fixed 9 b141Fixed openjdk7uFixed
Description
We should provide more information about which ciphersuites were actually considered for a handshake and why they were ultimately chosen/not chosen, but for now, add a debug message to indicate whether or not a chosen ciphersuite was legacy.

Examples:  

% java -Djavax.net.debug=all MyClass   // or  % java -Djavax.net.debug=ssl MyClass
    ...deleted...
    Standard ciphersuite chosen:  TLS_RSA_WITH_AES_128_CBC_SHA
    ...deleted...

or

    ...deleted...
    Legacy ciphersuite chosen:  SSL_RSA_WITH_RC4_128_SHA
    ...deleted...
Comments
UR SQE OK to take the fix in CPU17_01: no any issues during nightly, it make sense to pair the fix with the corresponding CPU fixes.
14-11-2016
Justification for backport: The number of TLS connections still using 3DES is small but non-negligible . In CPU17_01, we are adding 3DES to the list of legacy TLS algorithms, which means 3DES-based ciphersuites will now only be selected as a last resort. When evaluating TLS connections during support incidents, it will be very helpful to know if the chosen ciphersuite was considered first-class (normal) or legacy (last resort). This fix could be PSU, but strongly prefer it be paired with the corresponding CPU fix when it will become much more visible.
07-11-2016