Details
-
Type:
Improvement
-
Status: Closed
-
Priority:
Major
-
Resolution: Fixed
-
Affects Version/s: None
-
Fix Version/s: 3.1.1
-
Component/s: None
-
Labels:None
-
Estimated Complexity:Unknown
Description
Currently, a CXF client uses either the explicitly defined ciphersuites (in configuration or via a System property), and then falls back to using inclusion + exclusion filters on the full list of supported cipher suites. However, from JDK7 onwards, the insecure ciphers (null, anon, DES, EXPORT, etc.) are all disabled by default. So for CXF 3.1.x, we can fall back to use the default cipher suites of the JVM instead. If filters are given in configuration then we will continue to use them.