For a list of the set of cipher suites supported by the JDK default JSSE provider, SunJSSE, see:

• JDK 17: The SunJSSE Provider in Security Developer’s Guide
• JDK 21: The SunJSSE Provider in Security Developer’s Guide

For backward compatibility, the JSSE-based SSL implementation accepts Certicom cipher suite names for cipher suites that are compatible with SunJSSE. The Certicom cipher suite names are converted for you to SunJSSE equivalents, usually replacing the "TLS_" prefix with "SSL_", as shown in Table 38-2.

Please keep the following in mind as you consider backward compatibility with Certicom cipher suites:

• With JSSE, the cipher suites selected by default are stronger as compared to Certicom SSL and have slower performance. The security policies in your environment typically set the requirements for the cipher suites that must be used. However, for highly secure environments, using the strongest available cipher that provides acceptable performance is recommended.

• For operations where enabled or supported cipher suites are returned, both the Certicom and SunJSSE names of the cipher suites are returned. (Note that the weblogic.security.SSL.disableJsseCipherSuiteAliases=true property, described in Table 38-1, disables this behavior.)

• For operations where you specify enabled cipher suites, you can use either the equivalent Certicom cipher suite names, or the SunJSSE names. The Certicom cipher suites, and their SunJSSE equivalents, are listed in Table 38-2. (Oracle does not encourage future use of Certicom cipher suite names.)

• The _DSS_ cipher suites requires certificates signed with DSS, the Digital Signature Standard defined by NIST FIPS Pub 186. DSA is the key generation scheme as described in FIPS 186.

• The _anon_ cipher suites are disabled by default. To enable them, you can use WebLogic Remote Console or WLST. See Set Cipher Suites in Oracle WebLogic Remote Console Online Help or Setting Cipher Suites Using WLST: An Example.

• The TLS DES cipher suites have been disabled at the JSSE provider level by default. See the Oracle JRE and JDK Cryptographic Roadmap at https://java.com/en/jre-jdk-cryptoroadmap.html.

The following anonymous ciphers are not supported out-of-the-box in the JSSE-based WebLogic SSL implementation in WebLogic Server:

• TLS_DH_anon_WITH_3DES_EDE_CBC_SHA

• TLS_DH_anon_WITH_RC4_128_MD5

• TLS_DH_anon_WITH_DES_CBC_SHA

• TLS_DH_anon_EXPORT_WITH_RC4_40_MD5

• TLS_DH_anon_EXPORT_WITH_DES40_CBC_SHA

However, if you want to enable any of the preceding anonymous ciphers, include the following argument in the Java command that starts WebLogic Server:

-Dweblogic.security.SSL.AllowAnonymousCipher=true

In most cases, enabling anonymous ciphers is required when WebLogic Server, or its deployed application, acts as a SSL client that is making an outbound connection to an SSL server (for example, an LDAP server or RDBMS system) that is configured to use anonymous ciphers only. A typical use case is connecting to an Oracle Internet Directory instance that is configured in no-auth mode.

The following example shows a WLST script that sets the cipher suites SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, and SSL_RSA_WITH_3DES_EDE_CBC_SHA. After this script is run, the cipher suites are set in the domain configuration (that is, the config.xml file) and the SSL listeners are restarted with the new cipher suite settings.

url="t3://localhost:7001"
adminUsername="weblogic"
adminPassword="password"
connect(adminUsername, adminPassword, url)
edit()
server=cmo.lookupServer('myserver')
cd('Servers')
cd('myserver')
startEdit()
cd('SSL')
cd('myserver')
ssl = server.getSSL()
ciphers = ['SSL_RSA_WITH_RC4_128_MD5', 'SSL_RSA_WITH_RC4_128_SHA', 'SSL_RSA_WITH_3DES_EDE_CBC_SHA']
ssl.setCiphersuites(ciphers)
save()
activate()
disconnect()
exit()

SSL clients start the SSL handshake by connecting to the server. As part of the connection, the client sends the server a list of the cipher suites it supports. The server then selects a mutually-supported cipher suite from the list supplied by the client for the client and server to use for this session.

However, an incorrectly configured client might specify a set of cipher suites that contain only null ciphers. A null cipher passes data on the wire in clear-text. (An example of a cipher suite with a null cipher is SSL_RSA_WITH_NULL_MD5.) Using a null cipher makes it possible to see the SSL messages by using a network packet sniffer. In essence, SSL is used but does not provide any security.

The server selects the null cipher only when it is the only cipher suite they have in common. If the server selects a null cipher from the client's cipher suite list, the log contains the following message: SSL has established a session that uses a Null cipher.

This message is output only when the server has selected a null cipher from the client's list.

Other SSL errors unrelated to null ciphers are possible as well, and each will display an appropriate error message in the log.

See Configuring SSL. For information on viewing log files, see View Logs in Oracle WebLogic Remote Console Online Help.