Skip to content

Disabling TLS Protocol Versions

QIE inherits its default set of TLS protocol versions from the JRE. Three mechanisms can restrict that set:

  1. jdk.tls.disabledAlgorithms in the JRE's java.security file: global to every Java application running on that JRE. List the protocol versions (and optionally algorithms) to disable in the jdk.tls.disabledAlgorithms line; the change applies after restarting QIE. Affects both inbound listeners and outbound calls.

  2. -Djdk.tls.client.protocols=TLSv1.2 JVM option: restricts outbound (client-side) calls QIE makes to remote servers. Multiple versions can be listed with commas: -Djdk.tls.client.protocols=TLSv1.2,TLSv1.3. Add the option to the QIE Service Manager's Java tab; does not affect inbound listeners.

  3. -Dqie.excludeProtocols.{port}=... JVM option: restricts a specific inbound listener port. For example, -Dqie.excludeProtocols.8443=TLSv1,TLSv1.1 removes TLSv1 and TLSv1.1 from the protocol set offered on port 8443; clients that can only negotiate those are rejected. Repeat the option per port (-Dqie.excludeProtocols.443=...).

In most deployments the simplest approach is option 1. Edit the JRE's java.security once, and QIE plus any other Java tools on the host all honor the policy. Use option 3 only when a specific listener needs a different policy from the rest of the host.