Is it possible to enable ECDHE cipher usage on the server for iProcess Engine?
Article ID: KB0138282
Updated On:
| Products | Versions |
|---|---|
| TIBCO iProcess Engine (Oracle) | 11.10 |
Description
Symptoms:
ECDH/ECDHE cipher suites are available in a standard JDK installation but are not present in the Java runtime packaged with iProcess Engine.
For example, when using the Java bundled with iProcess:
```
java -version
java version "11.0.14" 2022-01-18 LTS
Java(TM) SE Runtime Environment 18.9 (build 11.0.14+8-LTS-263)
Java HotSpot(TM) 64-Bit Server VM 18.9 (build 11.0.14+8-LTS-263, mixed mode)
```
Executing the ListCiphers utility displays 21 supported and enabled cipher suites. The output includes TLS_DHE and TLS_RSA variants but does not list any TLS_ECDH or TLS_ECDHE cipher suites.
In contrast, running the same utility on a standard JDK 11 installation shows 45 supported and enabled cipher suites. This list includes additional TLS_ECDH and TLS_ECDHE cipher suites, which are absent in the iProcess-bundled Java runtime.
This confirms that ECDH/ECDHE-based cipher suites are not available in the Java distribution provided with iProcess Engine, while they are available in a standard JDK installation of the same version.
Environment
iProcess Engine – All supported versions on all supported Operating Systems
Resolution
To prevent licensing conflicts, the Elliptic Curve Cryptography (ECC) library (sunec.dll on Windows / libsunec.so on Linux) has been removed from the Java runtime distributed with iProcess Engine.
As a result, ECDH and ECDHE algorithms are not supported in the Java version bundled with iProcess Engine.
Issue/Introduction
Is it possible to enable ECDHE cipher usage on the server for iProcess Engine?
