Fix SSL self-signed certificate, update cipher suite #984
Conversation
When does it not work? Can we have a unit test for that particular case? |
| @@ -148,6 +144,11 @@ public Integer start(String[] args) { | |||
| return Integer.valueOf(-2); | |||
| } | |||
|
|
|||
| String builtWithMessage = "freenet.jar built with freenet-ext.jar Build #" + ExtVersion.buildNumber + " r" + ExtVersion.cvsRevision+" running with ext build "+extBuildNumber+" r" + extRevisionNumber; | |||
There was a problem hiding this comment.
This seems unrelated to the PR.
What's the reason for moving this around?
There was a problem hiding this comment.
It appeared before logging is started, and I don't find this message in the log file, so I moved it to after logging started.
It's because Oracle doesn't want to let it work in all J2SE run-times. See https://stackoverflow.com/questions/29060064/sun-security-x509-certandkeygen-and-sun-security-pkcs-pkcs10-missing-in-jdk8 |
| @@ -1989,7 +1989,10 @@ SimpleToadletServer.sendAllThemesLong=If set true, all available themes will be | |||
| SimpleToadletServer.ssl=Enable SSL? | |||
| SimpleToadletServer.sslLong=Enable SSL on the web interface. You will need the 'Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files' for it to work. | |||
| SSL.enable=Activate SSL support? | |||
| SSL.HSTS=HTTP Strict-Transport-Security max-age | |||
| SSL.HSTSLong=Set the time, in seconds, that the browser is forced to access the web interface using HTTPS. If set to 0 or if SSL is disabled, HSTS header will be disabled. | |||
There was a problem hiding this comment.
Please add a note that a large value here could cause the site to become inaccessible if SSL fails. It would be good to suggest a value of a week here: note how many seconds to set so if the node is accessed at least once a week it ensures SSL access. ⇒ 10080 seconds.
Old self-signed certificate generation doesn't always work with Oracle JVM, so I replaced it with the one which use bouncycastle.
Also the node does not try to create a self-signed certificate on start up, because the entropy collection has not yet started when initializing SSL. The self-signed certificate is created when the user turns on SSL.
Finally, SSL cipher suites with weak CBC methods are removed, and SSL cipher suites with AES 256 are added.
In the future, we should allow to import valid SSL certificate and private key.