title: How to reactivate TLS1.0 in JRE8u60
body: <p>We have a Java desktop product that our customers (small businesses) use (among other things) to communicate with larger insurers via a few different SOAP protocols. (We are the SOAP client). The point here is that the insurers are the gorillas in the room - we just enable the communication between the insurers and our customers. </p>
  
  <p>We use AXIS1 as our SOAP client library. Ordinarily is works perfectly and it has for years.</p>
  
  <p>One major insurer is still using TLS1.0 for their SOAP server. We have no influence over this any more than the international space station affects the orbit of the earth.</p>
  
  <p>Unfortunately (for us) the latest Java version 8u60 automatically disables TLS1.0. 
  see <strong>JDK-8076221</strong> : Disable RC4 cipher suites 
  at <a href="http://bugs.java.com/view_bug.do?bug_id=8076221" rel="nofollow">http://bugs.java.com/view_bug.do?bug_id=8076221</a> </p>
  
  <p>So now we have customers who cannot connect via 8u60. We can revert them to 8u51, but that is short term at best.</p>
  
  <p><strong>JDK-8076221</strong> gives a few clues on how to re-enable TLS1.0 as follows ... </p>
  
  <blockquote>
    <p>These cipher suites can be reactivated by removing "RC4" form
    "jdk.tls.disabledAlgorithms" security property in the java.security
    file or by dynamically calling Security.setProperty(), and also
    readding them to the enabled ciphersuite list using the
    SSLSocket/SSLEngine.setEnabledCipherSuites() methods.</p>
  </blockquote>
  
  <p>Unfortunately for someone like me (who has relied on the security layer being abstracted away) this is not enough information.</p>
  
  <p>Comments</p>
  
  <ul>
  <li>TLS level control is not my thing - we have relied on AXIS etc to do
  all of that behind the scenes so there is a large body of knowledge
  that is not familiar to me.</li>
  <li>We have no control on the insurer using a TLS1.0 interface. </li>
  <li>If we don't get a work around here our customers will simply be forced to use other products
  that will use TLS1.0 - so we can't play hard ball and save anyone
  here. They will be using TLS1.0 until the insurer decides otherwise.</li>
  <li>A dynamic (code based) solution is preferred to any command line solution because we are a desktop application that will find command line deployment <em>extremely</em> problematic.</li>
  </ul>
  
  <p>Can anyone provide some more detailed clues on how to programatically enable TLS1.0 in Java 8u60? </p>
  
  <p>Perhaps something like ...</p>
  
  <pre><code>Security.setProperty("jdk.tls.disabledAlgorithms", "SSLv3");
  SSLContext sslCtx = SSLContext.getInstance("TLS");
  SSLSocket.setEnabledCipherSuites("please help me!");
  SSLEngine.setEnabledCipherSuites("please help me!");
  </code></pre>
  
  <p>Many thanks for your time,
  -Damian</p>