title: How can I disable TLS_RSA_WITH_AES_128_CBC_SHA without disabling others as well?
body: <p>I'm trying to narrow down the allowed SSL ciphers for a java application.  In the java.security file, I am using:</p>
  
  <blockquote>
    <p>jdk.tls.disabledAlgorithms=SSLv2Hello, SSLv3, TLSv1, TLSv1.1, 3DES_EDE_CBC, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256</p>
  </blockquote>
  
  <p>Which produces the following allowed ciphers:</p>
  
  <pre><code>Will-Adams-MacBook-Air:~ Looker$ nmap -script ssl-enum-ciphers -p 9999 &lt;AWS INSTANCE&gt;.compute.amazonaws.com
  Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-06 14:23 PDT
  Nmap scan report for &lt;AWS INSTANCE&gt;.compute.amazonaws.com
  Host is up (0.079s latency).
  
  PORT     STATE SERVICE
  9999/tcp open  abyss
  | ssl-enum-ciphers:
  |   TLSv1.2:
  |     ciphers:
  |       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (dh 1024) - A
  |       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (secp256r1) - A
  |       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (secp256r1) - A
  |       TLS_RSA_WITH_AES_128_CBC_SHA (rsa 1024) - A
  |     compressors:
  |       NULL
  |     cipher preference: client
  |     warnings:
  |       Weak certificate signature: SHA1
  |_  least strength: A
  
  Nmap done: 1 IP address (1 host up) scanned in 3.39 seconds
  </code></pre>
  
  <p>Great!  I'm almost there.  I want to also disallow <code>TLS_RSA_WITH_AES_128_CBC_SHA</code> but adding it to the <code>jdk.tls.disabledAlgorithms</code> disables everything:</p>
  
  <pre><code>Will-Adams-MacBook-Air:~ Looker$ nmap -script ssl-enum-ciphers -p 9999 &lt;AWS INSTANCE&gt;.compute.amazonaws.com
  Starting Nmap 7.70 ( https://nmap.org ) at 2018-09-06 14:28 PDT
  Nmap scan report for &lt;AWS INSTANCE&gt;.compute.amazonaws.com 
  Host is up (0.079s latency).
  
  PORT     STATE SERVICE
  9999/tcp open  abyss
  
  Nmap done: 1 IP address (1 host up) scanned in 0.85 seconds
  </code></pre>
  
  <p>Why is this?  Is there a way for me to disable <code>TLS_RSA_WITH_AES_128_CBC_SHA</code> without also disabling <code>TLS_DHE_RSA_WITH_AES_256_GCM_SHA384</code>, <code>TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384</code>, and <code>TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384</code>?</p>