How to enable SSL 3 in Java

Question

Since Java 8 Update 31 the SSL 3 protocol is disabled by default due to security flaws in the SSL Protocol (see POODLE attack).

Even if not recommended, how can it be enabled?

Answer 1

Unless you have no choice other than using SSL 3, the link below explains the configuration.

The release notes for the update 31 provide information for enabling the SSL 3 again in Java.

As stated:

If SSLv3 is absolutely required, the protocol can be reactivated by removing "SSLv3" from the jdk.tls.disabledAlgorithms property in the java.security file or by dynamically setting this Security property to "true" before JSSE is initialized.

Keep in mind that even the TLS protocol can be exploited to allow an insecure access with SSL 3, thats also part of the POODLE flaw. Enabling this for Java or any other technology should be a last resort only for critical reasons.

Answer 2

You can set the jdk.tls.disabledAlgorithms security property at runtime like so.

static {
    Security.setProperty("jdk.tls.disabledAlgorithms", "");
}