EC2 Linux机器上安装的OpenJDK 8不支持ECDHE密码套件

Question

从在EC2 Amazon Linux计算机上运行开始时jetty-distribution-9.3.0.v20150612，openjdk 1.8.0_51将显示不支持所有已配置的ECDHE套件的打印。

2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_CAMELLIA_256_CBC_SHA384 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_CAMELLIA_128_CBC_SHA256 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_DHE_RSA_WITH_CAMELLIA_256_CBC_SHA256 not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA not supported
2015-08-12 16:51:20 main SslContextFactory [INFO] Cipher TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA not supported

这些在jetty/etc/jetty-ssl-context.xml- 中启用

<Set name="IncludeCipherSuites">
<Array type="java.lang.String">
 <!-- TLS 1.2 AEAD only (all are SHA-2 as well) -->
  <Item>TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256</Item>
  <Item>TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256</Item>
  <Item>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</Item>
  <Item>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</Item>
  <Item>TLS_DHE_RSA_WITH_AES_256_GCM_SHA384</Item>
  <Item>TLS_DHE_RSA_WITH_AES_128_GCM_SHA256</Item>
...

我读过Oracle Java 8
应该支持这些协议，但是OpenJDK可能不支持这些协议吗？还是应该以某种方式启用它？

更新资料

Oracle的JCE加密提供程序安装在下jre/lib/security/，但没有帮助。

Answer 1

因此，我正在运行类似的设置，其中一个AWS盒子运行openjdk-1.8.0.51。为我解决的是像这样添加bouncycastle作为提供程序：

• 添加bcprov-<verion>.jar到/usr/lib/jvm/jre/lib/ext

• 编辑/usr/lib/jvm/jre/lib/security/java.security将以下行添加到提供程序列表中：

  security.provider.6=org.bouncycastle.jce.provider.BouncyCastleProvider
  

（我将其添加为第六项，但如果愿意，可以按顺序添加更高的项）

重新启动了我的应用程序，并能够使用基于EC的密码套件，例如TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256。