title: How do I disallow particular SSL protocols in Jetty?
body: <p>I have a web application running on Jetty 6 + Open JDK 7 on Debian 6.0.7.  I have a security requirement to accept a TLS handshake but <em>not</em> an SSLv3.0 handshake when a client initiates an HTTPS connection.</p>
  
  <p>In my jetty.xml I set the protocol to TLS:</p>
  
  <pre><code>&lt;New class="org.mortbay.jetty.security.SslSocketConnector"&gt;
      &lt;Set name="protocol"&gt;TLS&lt;/Set&gt;
      ...
  </code></pre>
  
  <p>With this configuration, the web server still appears to accept an SSLv3.0 handshake.  This has been verified with the 'sslscan' tool and running 'curl -sslv3 -kv {host}'.</p>
  
  <p>Is it possible to configure Jetty to only accept a TLS handshake?  I would be willing to upgrade my Jetty version if needed.</p>