447381 - Disable SSLv3 by default.

Excluded by default SSL, SSLv2 and SSLv3.
2014-10-16 17:53:52 +02:00 · 2014-10-16 17:53:52 +02:00 · aea5070e51
parent f2eaa963f8
commit aea5070e51
1 changed files with 1 additions and 1 deletions
--- a/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SslContextFactory.java
+++ b/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SslContextFactory.java
@ -44,7 +44,6 @@ import java.util.Set;
 import java.util.concurrent.CopyOnWriteArraySet;
 import java.util.regex.Matcher;
 import java.util.regex.Pattern;
-
 import javax.net.ssl.CertPathTrustManagerParameters;
 import javax.net.ssl.KeyManager;
 import javax.net.ssl.KeyManagerFactory;
@ -224,6 +223,7 @@ public class SslContextFactory extends AbstractLifeCycle
    public SslContextFactory(boolean trustAll)
    {
        setTrustAll(trustAll);
+        addExcludeProtocols("SSL", "SSLv2", "SSLv3");
    }

    /**