puppetlabs/puppetdb — pull request #512 by grimradical (2013-05-13 19:19:48+00:00)
Title: (#19884) Intermittent SSL handshake error

Certain versions of the JDK (1.7u6 and newer) appear to have a bug when
handling Diffie-Hellman exchange during SSL handshaking with OpenSSL
clients. Bug is discussed here:

https://forums.oracle.com/forums/thread.jspa?messageID=10999587

In me tests just having openssl's s_client connect to PuppetDB
repeatedly in a tight loop, we see the handshake error about 0.4% of the
time. So it's not a pervasive problem, but it's certainly annoying and
something users have seen and complained about somewhat regularly.

There are a few options available for fixing the problem:

1) Wait for Oracle to fix the problem. This is, of course, suboptimal.

2) Use BouncyCastle JSSE providers instead. This is workable, but in my
research would require changes to the JDK system policy files, which is
a huge PITA. There's also some concern about performance, if the BC
providers are markedly slower than the JSSE ones.

3) Disable the DHE ciphers.

This patchset implements option #3. The non-DHE cipher suites work fine,
support SSL and TLS, and are on the NIST and FIPS approved list. So...it
sucks that we need to disable the DHE cipher suites, but in an insane
world it's the sanest choice.

I've added a new option to the [jetty] section of the configuration file
called `cipher-suites`. It allows users, should they have the need, to
override the list of cipher suites used to one of their choosing.