I've seen lots of examples of disabling TLS ciphers in java using [jdk.tls.disabledAlgorithms](https://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html#DisabledAlgorithms), for example:

```
 jdk.tls.disabledAlgorithms=MD2, RSA keySize < 1024, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

```

**But how can I disable a cipher for only certain protocols, using `jdk.tls.disabledAlgorithms` or a similar config?**

For example, how can I disable `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256` for `TLSv1.1` only?

It doesn't seem to support the `opensssl` way of doing this, which is like so:

```
TLSv1.1:!TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256

```

It doesnt cause any errors, but the cipher is still allowed.

EDIT: Note that I'm only really interested in JVM config based answers, as I don't control the code that's on lots of these servers, just the JVM and JVM configurations. Some are even 3rd party servers, so more of an ops level thing than anything.

EDIT 2: Note that you can run a java app and supply arguments that change which protocols and ciphers are used, e.g. `java -server -Djava.security.properties=./my/custom/java.security -jar myapp.jar` will do it - but it wont let you filter ciphers by protocol, only ciphers, or protocols, from what I can see. The file would contain a property entry like `jdk.tls.disabledAlgorithms`