小编Kon*_*iak的帖子

所以这是我的Java ssl Server的代码.ctx是SSLContext使用服务器密钥库初始化的.

public SSLEngine createSSLEngine() {

        SSLEngine sslEngine = ctx.createSSLEngine();

        String[] ciphersuites = new String[]{
                "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
                "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
                "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
                "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
                "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
        };

        sslEngine.setEnabledCipherSuites(ciphersuites);

        sslEngine.setUseClientMode(false);

        return sslEngine;
    }

我cipherscan(测试它https://github.com/jvehent/cipherscan),选择密码看起来很好,但服务器支持所有可能的椭圆曲线(sect163k1,sect163r1,sect163r2,sect193r1,sect193r2,sect233k1,sect233r1,sect239k1,sect283k1 ,sect283r1,sect409k1,sect409r1,sect571k1,sect571r1,secp160k1,secp160r1,secp160r2,secp192k1,prime192v1,secp224k1,secp224r1,secp256k1,prime256v1,secp384r1,secp521r1).

有没有办法禁用所有曲线,除了像secp384r1这样的强曲线？