如果在Jetty logs下禁用了密码，JreDisabled:java.security意味着什么

Question

我正尝试在使用TLS_PSK_WITH_AES_256_CBC_SHA的安卓应用程序上运行Jetty服务器，但是我发现它没有列在enabled下面。

    private static final String[] suites = {
            "TLS_PSK_WITH_AES_256_CBC_SHA"
    };

    SslContextFactory ctxFactory = new SslContextFactory();
    ctxFactory.setExcludeCipherSuites(new String[0]);
    ctxFactory.setIncludeCipherSuites(suites);

以下是启动服务器后的Jetty转储日志：

   |       +- Protocol Selections
   |       |   +- Enabled (size=4)
   |       |   |   +- TLSv1
   |       |   |   +- TLSv1.1
   |       |   |   +- TLSv1.2
   |       |   |   +- TLSv1.3
   |       |   +- Disabled (size=0)
   |       +- Cipher Suite Selections
   |           +- Enabled (size=0)
   |           +- Disabled (size=25)
   |               +- SSL_RSA_WITH_3DES_EDE_CBC_SHA - JreDisabled:java.security, ConfigIncluded:NotSpecified
   |               +- TLS_AES_128_GCM_SHA256 - ConfigIncluded:NotSpecified
   |               +- TLS_AES_256_GCM_SHA384 - ConfigIncluded:NotSpecified
   |               +- TLS_CHACHA20_POLY1305_SHA256 - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA - JreDisabled:java.security, ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA - JreDisabled:java.security, ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 - JreDisabled:java.security, ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 - ConfigIncluded:NotSpecified
   |               +- TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 - ConfigIncluded:NotSpecified
   |               +- TLS_EMPTY_RENEGOTIATION_INFO_SCSV - ConfigIncluded:NotSpecified
   |               +- TLS_FALLBACK_SCSV - JreDisabled:java.security, ConfigIncluded:NotSpecified
   |               +- TLS_PSK_WITH_AES_128_CBC_SHA - JreDisabled:java.security, ConfigIncluded:NotSpecified
   |               +- TLS_PSK_WITH_AES_256_CBC_SHA - JreDisabled:java.security
   |               +- TLS_RSA_WITH_AES_128_CBC_SHA - ConfigIncluded:NotSpecified
   |               +- TLS_RSA_WITH_AES_128_GCM_SHA256 - ConfigIncluded:NotSpecified
   |               +- TLS_RSA_WITH_AES_256_CBC_SHA - ConfigIncluded:NotSpecified
   |               +- TLS_RSA_WITH_AES_256_GCM_SHA384 - ConfigIncluded:NotSpecified

JreDisabled:java.security是什么意思？Jetty是否支持此TLS_PSK_WITH_AES_256_CBC_SHA加密套件？

Answer 1

这意味着您正在运行的JRE (或JDK)在属于该JRE的配置中禁用了特定的TLS Cipher Suite (或TLS协议)。

示例:在OpenJDK 11上

$ grep -A2 tls.disabledAlgo $JAVA_HOME/conf/security/java.security
jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, \
    DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL, \
    include jdk.disabled.namedCurves