title: Java SSL Server disable weak elliptic curves
body: <p>So this is the code of my Java ssl Server. <code>ctx</code> is an <code>SSLContext</code> initialised with the server keystore.</p>
  
  <pre><code>public SSLEngine createSSLEngine() {
  
          SSLEngine sslEngine = ctx.createSSLEngine();
  
          String[] ciphersuites = new String[]{
                  "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
                  "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
                  "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384",
                  "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
                  "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
                  "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
                  "TLS_EMPTY_RENEGOTIATION_INFO_SCSV"
          };
  
          sslEngine.setEnabledCipherSuites(ciphersuites);
  
          sslEngine.setUseClientMode(false);
  
          return sslEngine;
      }
  </code></pre>
  
  <p>I tested it with cipherscan (<a href="https://github.com/jvehent/cipherscan">https://github.com/jvehent/cipherscan</a>), the ciphersuites look fine, but the server supports all possible elliptic curves (sect163k1, sect163r1, sect163r2, sect193r1, sect193r2, sect233k1, sect233r1, sect239k1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, secp192k1, prime192v1, secp224k1, secp224r1, secp256k1, prime256v1, secp384r1, secp521r1).</p>
  
  <p>Is there a way to disable all curves, except the strong ones like secp384r1?</p>