secure jetty ssl configuration

[philippeu]

Hello,
restlet does not expose all jetty (9.2.14) ssl configuration parameters like

• ssl renegociation, true by default in jetty allowing dos
• cipher suite order (9.3.8)

should be great to add these in future release.
also, having an upgrade of jetty to 9.3.8 would be interesting in order to support sni.

[thboileau]

Hello,

from what I see, ssl renegotiation is configured on the org.eclipse.jetty.util.ssl.SslContextFactory class.

So, as a workaround, I think you can provide your own configured instance of SslContextFactoryas follow:

org.eclipse.jetty.util.ssl.SslContextFactory sslContextFactory = new org.eclipse.jetty.util.ssl.SslContextFactory();
sslContextFactory.setRenegotiationAllowed(false);
// Then call sslContextFactory.setKeyStore* for configuring manually the factory

Component component = new Component();

// Add a new HTTPS server listening on port 8183
Server server = component.getServers().add(Protocol.HTTPS, 8183);
server.getContext().getAttributes().put("sslContextFactory", sslContextFactory);

// Attach the sample application.
component.getDefaultHost().attach("", new SampleApplication());

// Start the component.
component.start();

I hope this will help you.
We keep the ticket open.

[philippeu]

Merci Thierry
i will have a look

[philippeu]

Hi Thierry,
sorry for the late response.
It is not possible to implement the workaround since JettyServerHelper.createConnector() is calling HttpsServerHelper.createConnectionFactories which is expecting an instance of org.restlet.engine.ssl.SslContextFactory via SslUtils.getSslContextFactory()