title: Struggling to enable SSLv2Hello in Apache CXF, Java 8, No Spring
body: <p>This is going to seem backwards, but I'm developing a web server specifically to interface with a third party client.  This third party client only supports SSLv3, TLSv1.0, or TLSv1.1.  </p>
  
  <p>I'm also seeing the following errors on my side when they try to connect: </p>
  
  <pre><code>SSLHandshakeException: SSLv2Hello is not enabled
  </code></pre>
  
  <p>I assume that means they also require SSLv2Hello to be enabled.  It's clearly not for me, although it seems to be available.  </p>
  
  <pre><code>2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Protocols [TLSv1.1, TLSv1] of [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
  2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Ciphers   [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] of [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
  </code></pre>
  
  <p>Not sure if this is a red herring, but if I try to do the following to SSLContext.getInstances, the TLSv1.1 call works fine, the SSLv2Hello throws a NoSuchAlgorithmException.  </p>
  
  <pre><code>SSLContext.getInstance( "TLSv1.1" )
  SSLContext.getInstance( "SSLv2Hello" )
  </code></pre>
  
  <p>The code I'm running to spin this thing up is still a mess since I'm prototyping, but it's below to get the gist of what I'm doing.  </p>
  
  <pre><code>        final String url = "https://myurl.com:443/Notices";
  
          TLSServerParameters params = new TLSServerParameters();
  
          List&lt;String&gt; certFilePaths = new ArrayList&lt;&gt;();
          certFilePaths.add( "COMODORSADomainValidationSecureServerCA.crt" );
          certFilePaths.add( "AddTrustExternalCARoot.crt" );
          certFilePaths.add( "COMODORSAAddTrustCA.crt" );
          certFilePaths.add( "MyCert.crt" );
  
          Utility.loadCertsToServerParams( certFilePaths, "SSL_Export.pfx", "/tmp/tmp.jks", "password", params ); //uses the ssl password as the temporary keystore password as well
  
          JettyHTTPServerEngineFactory serverEngineFactory = new JettyHTTPServerEngineFactory();
          serverEngineFactory.setTLSServerParametersForPort( 443, params );
  
          Consumer implementor = new Consumer();
          JaxWsServerFactoryBean factory = new JaxWsServerFactoryBean();
          factory.setServiceClass( Consumer.class );
          factory.setAddress( url );
          factory.setServiceBean( implementor );
  
          Map&lt;String, Object&gt; properties = Maps.newHashMap();
          properties.put( "mtom-enabled", "false" );
          factory.setProperties( properties );
  
          final Map&lt;String, Object&gt; inProps = Utility.getWsSecurityPropertiesForSSL( "/tmp/tmp.jks", "SSL_Export.pfx", "password", "SSL_Export" );
  
          WSS4JInInterceptor wssOut = new WSS4JInInterceptor( inProps );
          factory.getInInterceptors().add( wssOut );
  
          ServerImpl server = ( ServerImpl ) factory.create();
  
          server.start();
  
  
  
  public static TrustManager[] loadCertsToServerParams( List&lt;String&gt; serverCertFilePaths, String sslTlsKeyPairPath, String tempPathForCertFileKeystore, String sslTslKeyPairPassword, TLSServerParameters params ) throws Exception
  {
      char[] sslTslKeyPairPasswordCharArray = sslTslKeyPairPassword.toCharArray();
  
      //clear out the keystore, we create a new one every time
      if( Files.exists( Paths.get( tempPathForCertFileKeystore ) ) )
          Files.delete( Paths.get( tempPathForCertFileKeystore ) );
  
      KeyStore ks = KeyStore.getInstance( "PKCS12" );
  
      ks.load( new FileInputStream( sslTlsKeyPairPath ), sslTslKeyPairPasswordCharArray );
  
      // Store away the newly created keystore.
      FileOutputStream fos = new FileOutputStream( tempPathForCertFileKeystore );
      ks.store( fos, sslTslKeyPairPasswordCharArray );
      fos.close();
  
      for( String certFilePath : serverCertFilePaths )
          AddCertToKeystore( ks, sslTslKeyPairPasswordCharArray, tempPathForCertFileKeystore, certFilePath, new File( certFilePath ).getName().replace( '.', '_' ) );
  
      TrustManagerFactory tmf = TrustManagerFactory.getInstance( TrustManagerFactory.getDefaultAlgorithm() );
      tmf.init( ks );
  
      KeyManagerFactory kmf = KeyManagerFactory.getInstance( KeyManagerFactory.getDefaultAlgorithm() );
      kmf.init( ks, sslTslKeyPairPasswordCharArray );
  
      SSLContext tls1_1Context = SSLContext.getInstance( "TLSv1.1" );
      tls1_1Context.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
      SSLContext.setDefault( tls1_1Context );
  
      SSLContext v2Hello = SSLContext.getInstance( "SSL" );
      v2Hello.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
  
      params.setTrustManagers( tmf.getTrustManagers() );
      params.setKeyManagers( kmf.getKeyManagers() );
      params.setSecureSocketProtocol( "SSL" );
      final List&lt;String&gt; additionalProtocols = new ArrayList&lt;&gt;();
      additionalProtocols.add( "SSLv2Hello" );
      additionalProtocols.add( "SSLv3" );
      additionalProtocols.add( "TLSv1" );
      additionalProtocols.add( "TLSv1.1" );
      additionalProtocols.add( "TLSv1.2" );
      params.setIncludeProtocols( additionalProtocols );
      params.setExcludeProtocols( null );
      final FiltersType cipherFilter = new FiltersType();
      cipherFilter.getInclude().add( ".*NULL.*" );
      cipherFilter.getInclude().add( ".*anon.*" );
      cipherFilter.getInclude().add( ".*EXPORT.*" );
      cipherFilter.getInclude().add( ".*DES.*" );
      cipherFilter.getInclude().add( ".*MD5" );
      cipherFilter.getInclude().add( ".*CBC.*" );
      cipherFilter.getInclude().add( ".*RC4.*" );
      cipherFilter.getInclude().add( ".*_.*" );
      cipherFilter.getInclude().add( ".*AES.*" );
      cipherFilter.getInclude().add( ".*_SHA" );
      cipherFilter.getExclude().add( "" );
      params.setCipherSuitesFilter( cipherFilter );
      final List&lt;String&gt; cipherSuites = new ArrayList&lt;&gt;();
      cipherSuites.add( "TLS_AES_128_GCM_SHA256" );
      cipherSuites.add( "TLS_AES_256_GCM_SHA384" );
      cipherSuites.add( "TLS_CHACHA20_POLY1305_SHA256" );
      cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" );
      cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" );
      cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" );
      cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" );
      cipherSuites.add( "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
      cipherSuites.add( "TLS_RSA_WITH_AES_256_GCM_SHA384" );
      cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" );
      cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" );
      cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" );
      cipherSuites.add( "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
      cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" );
      cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" );
      cipherSuites.add( "TLS_RSA_WITH_AES_128_GCM_SHA256" );
      cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" );
      cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" );
      cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" );
      cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" );
      cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" );
      cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" );
      cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA256" );
      cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" );
      cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" );
      cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" );
      cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" );
      cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" );
      cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" );
      cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA" );
      cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" );
      cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" );
      cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" );
      cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" );
      cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" );
      cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" );
      cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA256" );
      cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" );
      cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" );
      cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" );
      cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" );
      cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" );
      cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" );
      cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA" );
      cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" );
      cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" );
      cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" );
      cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" );
      cipherSuites.add( "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" );
      params.setCipherSuites( cipherSuites );
  
      return tmf.getTrustManagers();
  }
  </code></pre>
  
  <p>I'm explicitly setting SSLv2Hello as an additional protocol as suggested in this Jetty github issue, what am I missing to get SSLv2Hello enabled?  </p>
  
  <p><a href="https://github.com/eclipse/jetty.project/issues/866" rel="nofollow noreferrer">https://github.com/eclipse/jetty.project/issues/866</a></p>