Search code examples
jbosswildflykeycloaktls1.2

Disable TLS V1.1, enable only TLSv1.2 on WildFly 20.0.1

I am not able to disable TLSv1.1 and 1.0 on WildFly 20.0.1. It is a Keycloak 11.0.0 installation. It's a clustered setup with two nodes in domain mode. I have tried as per documentation, as below under host-master.xml

<ssl>
 <engine enabled-protocols="TLSv1.2"/>
 <keystore ..... />
</ssl>

and even below in domain.xml

<https-listener name="https" socket-binding="https" record-request-start-time="true" security-realm="UndertowRealm" enable-http2="true" enabled-protocols="TLSv1.2"/>

These above configuration doesn't work.

I have tried with JDK8 and JDK11.

Solution

  • It works with the above configurations. I missed that I had another gateway device in front, which was allowing TLS1. Clients were seeing the SSL sessions from the front device.