38 Using the JSSE-Based SSL Implementation

This explains how to use the JSSE-based SSL implementation, identifies the cipher suites that are supported, describes key differences with the Certicom-based implementation, and also explains how to use the RSA JSSE provider with WebLogic Server.


Note the following:

  • As of WebLogic Server version 12.1.1, JSSE is the only SSL implementation that is supported. The Certicom-based SSL implementation is removed and is no longer supported in WebLogic Server.

  • SHA-2 signed certificates are supported in the JSSE SSL implementation provided in WebLogic Server.

  • Although JSSE supports Server Name Indication (SNI) in its SSL implementation, WebLogic Server does not support SNI.

This chapter includes the following sections:

System Property Differences Between the JSSE-Based and Certicom SSL Implementations

Table 38-1 shows the differences in how the JSSE-based SSL implementation handles the WebLogic system properties.

Table 38-1 System Properties Differences

System Property JSSE Applicability Description

This property continues to work and is not affected by the JSSE integration.

Does not verify the hostname in the URL to the hostname in the certificate.


This property continues to work and is not affected by the JSSE integration.

If set to true then use reverse DNS lookup to figure out if urlhostname is a loopback address ("localhost" or "", or the IPV6 equivalent.


This property continues to work and is not affected by the JSSE integration.

Loads the trusted CA certificates from that keystore.


Use this property in combination with javax.net.debug=all to get verbose debug output from the SSL calling code and the JSSE-based implementation.Foot 1

For additional SSL debugging when -Dssl.debug=true is used.


Use this property in combination with javax.net.debug=ssl to get debug output from the SSL calling code and the JSSE-based implementation.Footref 

Displays SSL debug information to the console or logs. This property is for the calling WebLogic code. The JSSE-based SSL implementation has its own logging system, which is activated by the javax.net.debug property.

Note: You can set JSSE logging (javax.net.debug) independently of WebLogic SSL logging (ssl.debug).


The default is false.

Disables the conversion of Certicom cipher suite names to SunJSSE cipher suite names, where applicable. By default, Certicom cipher suite names are converted to JSSE cipher suite names when JSSE is used for SSL.

For a list of Certicom cipher suite names and their SunJSSE equivalents, see Table 38-2.


This property continues to work and is not affected by the JSSE integration.

See weblogic.security.SSL.ignoreHostnameVerification


This property continues to work and is not affected by the JSSE integration.

Specifies the class name of a custom hostname verification class.


This property continues to work and is not affected by the JSSE integration.

The supported protocol values are mapped to the corresponding protocols supported by JSSE.

See Specifying the SSL Protocol Version.

One of the following:

  • weblogic.security.SSL.allowUnencryptedNullCipher

  • SSLMBean. SetAllowUnencryptedNullCipher(boolean)

  • weblogic.security.disableNullCipher

SunJSSE supports the following two null ciphers, but they are not enabled by default:



If this setting is enabled, these two null ciphers are added to the cipher list.

By default, this control is not set and the use of a null cipher is not allowed on the server. In such a configuration, if the SSL clients want to use the null cipher suite (by indicating SSL_RSA_WITH_NULL_MD5 as the only supported cipher suite), the SSL handshake will fail.

If you set this control, the null cipher suite (for example, SSL_RSA_WITH_NULL_MD5) is added to the list of supported cipher suites by the server. The SSL connection has a chance to use the null cipher suite if the client wants to do so. If the null cipher suite is used, the message will be unencrypted.

Caution: Do not set this control in a production environment unless you are aware of the implications and consequences of doing so.


Off is not supported, but other options are supported.

Ensures that the Basic Constraints extension on the CA certificate is defined as CA. See Controlling the Level of Certificate Validation.


Not supported.

WebLogic Server offers limited support for Certificate Policy Extensions in X.509 certificates. See Accepting Certificate Policies in Certificates.


Not supported.

See Setting Up SSL: Main Steps.

Footnote 1

This WebLogic system property is applicable to both the Certicom and JSSE-based SSL implementations. However, for JSSE, this property affects only the SSL calling code, not the JSSE-based implementation. For more information about the javax.net.debug system property and debugging the JSSE-based SSL implementation, see "Debugging Utilities" in the Java Secure Socket Extension (JSSE) Reference Guide at http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#Debug.

SSL Performance Considerations

Because WebLogic Server is configured with JDK 8, you may find that the out-of-the-box SSL performance slower than in previous WebLogic Server releases. This performance change is due to the stronger cipher and MAC algorithm used by default when JDK 8 is used with the JSSE-based SSL provider in WebLogic Server. Specifically, AES is used for encryption, and SHA1 is used for hashes. (This cipher combination is typically designated as AES + SHA1 here; that is, cipher + MAC algorithm.)

Previous versions of WebLogic Server used the RC4 and MD5 cipher combination (RC4 + MD5) for SSL connections. In terms of performance, AES + SHA1 is slower than RC4 + MD5. Although AES + SHA1 is recommended, you can configure WebLogic Server to restrict the stronger ciphers and cause RC4 + MD5 to be used instead for SSL. Although RC4 + MD5 is less secure than AES + SHA1, it may be acceptable depending on the security requirements of a particular WebLogic Server environment.


Oracle strongly recommends the stronger security provided by AES + SHA1 for SSL connections.

To configure WebLogic Server to use RC4 + MD5, add the following property to the file JAVA_HOME/jre/lib/security/java.security:

jdk.tls.disabledAlgorithms=AES, DESede, DES, SHA1, SHA

The preceding property disables the stronger ciphers that are used by default for SSL connections and allows RC4 + MD5 to be used instead.

Cipher Suites

This topic includes the following sections:

List of Supported Cipher Suites

The set of cipher suites supported by the JDK default JSSE provider, SunJSSE, is available at the following URL:


Backward Compatibility of Supported Cipher Suites

For backward compatibility, the JSSE-based SSL implementation accepts Certicom cipher suite names for cipher suites that are compatible with SunJSSE. The Certicom cipher suite names are converted for you to SunJSSE equivalents, usually replacing the "TLS_" prefix with "SSL_", as shown in Table 38-2.

Please keep the following in mind as you consider backward compatibility with Certicom cipher suites:

  • With JSSE, the cipher suites selected by default are stronger as compared to Certicom SSL and have slower performance. The security policies in your environment typically set the requirements for the cipher suites that must be used. However, for highly secure environments, using the strongest available cipher that provides acceptable performance is recommended.

  • For operations where enabled or supported cipher suites are returned, both the Certicom and SunJSSE names of the cipher suites are returned. (Note that the weblogic.security.SSL.disableJsseCipherSuiteAliases=true property, described in Table 38-1, disables this behavior.)

  • For operations where you specify enabled cipher suites, you can use either the equivalent Certicom cipher suite names, or the SunJSSE names. The Certicom cipher suites, and their SunJSSE equivalents, are listed in Table 38-2. (Oracle does not encourage future use of Certicom cipher suite names.)

  • The _DSS_ cipher suites requires certificates signed with DSS, the Digital Signature Standard defined by NIST FIPS Pub 186. DSA is the key generation scheme as described in FIPS 186.

  • The _anon_ cipher suites are disabled by default, and cannot be managed from the WebLogic Server Administration Console. You must use WLST instead, as described in Setting Cipher Suites Using WLST: An Example.

  • To use the Kerberos cipher suites TLS_KRB5_***, you must have KDC accounts set up. See the Java Secure Socket Extension (JSSE) Reference Guide (http://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#KRB) for more details on the Kerberos requirements.

Using Anonymous Ciphers

The following anonymous ciphers are not supported out-of-the-box in the JSSE-based WebLogic SSL implementation in WebLogic Server:


  • TLS_DH_anon_WITH_RC4_128_MD5


  • TLS_DH_anon_EXPORT_WITH_RC4_40_MD5


However, if you want to enable any of the preceding anonymous ciphers, include the following argument in the Java command that starts WebLogic Server:


In most cases, enabling anonymous ciphers is required when WebLogic Server, or its deployed application, acts as a SSL client that is making an outbound connection to an SSL server (for example, an LDAP server or RDBMS system) that is configured to use anonymous ciphers only. A typical use case is connecting to an Oracle Internet Directory instance that is configured in no-auth mode.


Oracle does not recommend the use of anonymous ciphers in production environments.

Cipher Suite Name Equivalents

By default, Certicom cipher suite names are converted to SunJSSE cipher suite names when WebLogic Server is configured to use the JSSE-based SSL implementation. Table 38-2 lists each cipher suite supported in the (removed) WebLogic Server Certicom SSL implementation and its SunJSSE equivalent. The TLS_ name is the Certicom cipher suite name; the SSL_ name is the equivalent SunJSSE provider cipher suite name.

Table 38-2 Cipher Suite Name Equivalence

Certicom Cipher Suite SunJSSE Equivalent Cipher Suite

Setting Cipher Suites Using WLST: An Example

The following example shows using a WLST script that sets the cipher suites SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, and SSL_RSA_WITH_3DES_EDE_CBC_SHA. After this script is run, the cipher suites are set in the domain configuration (that is, the config.xml file) and the SSL listeners are restarted with the new cipher suite settings.

connect(adminUsername, adminPassword, url)
ssl = server.getSSL()

Using Debugging with JSSE SSL

As described in SSL Debugging, SSL debugging provides more detailed information about the SSL events that occurred during an SSL handshake and other operations.

If you debug SSL when the JSSE-based SSL implementation is enabled, you can use the logging properties listed and described in Table 38-1. However, some properties affect only the SSL calling code and not the JSSE implementation. The JSSE-based SSL implementation has its own logging system, which is activated by the javax.net.debug property. The javax.net.debug property provides multiple levels of control over the amount of output and can be used independently of WebLogic SSL logging (ssl.debug).

See the "Debugging Utilities" section of the Java Secure Socket Extension (JSSE) Reference Guide, available at the following URL, for more details about the javax.net.debug property:


Using the RSA JSSE Provider in WebLogic Server


This section describes using the RSA JSSE provider in non-FIPS mode. You can also use the RSA JSSE provider in FIPS mode as described in Enabling FIPS Mode.

RSA JSSE is a third-party JSSE provider that can be statically registered in the JVM if you wish to use it. To install and configure the RSA JSSE provider, complete the following steps:

  1. Using the following URL, download and install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files that correspond to the version of your JDK. These Java policy JAR files affect cipher key sizes greater than 128 bits.

    Open the .ZIP distribution and update local_policy.jar and US_export_policy.jar in JAVA_HOME/jre/lib/ security. See the README.txt file in the .ZIP distribution for more information and installation instructions.

  2. Using a text editor, modify the file JAVA_HOME/jre/lib/security/java.security by making the RSA JSSE provider, com.rsa.jsse.JsseProvider, as the first provider in the list.

    For example, before making this update, the list of providers might appear as follows:

    # List of providers and their preference orders (see above):

    After you add the RSA JSSE provider, the list might appear as follows:

    # List of providers and their preference orders (see above):

    That is, you need to update the sequence number of each subsequent provider. For example, security.provider.1=sun.security.provider.Sun is changed to security.provider.2=sun.security.provider.Sun (change shown in bold).

  3. Add the SSL-J jar WL_HOME/server/lib/sslj.jar at the head of the classpath. You can use the PRE_CLASSPATH environment variable to do this.

    For example, you could set sslj.jar in the PRE_CLASSPATH variable before you call the server start script, typically startWebLogic.cmd/sh:

    set PRE_CLASSPATH=%MW_HOME%\wlserver\server\lib\sslj.jar
  4. Restart WebLogic Server for the change to the RSA JSEE provider to take effect.