将 JSF2.2 应用程序从 Glassfish3 升级到 Glassfish5

Question

Due to a vulnerability with Glassfish 3.1.2 (The host still accepts TLSv1.0 which is deprecated and has issues), I've been asked to migrate a JSF 2.2 web application to Glassfish 5.0.1.

Is there any way to stop using TLSv1.0 on GlassFish 3.1.2?

If not, what are the steps to follow for being compatible with this Glassfish 5.0.0 in terms of dependencies, JSF version, and so on, in the web app?

Many thanks in advance

Answer 1

To disable TLSv1.0 on GlassFish on the admin console go to Configurations->server-config->HTTP Service->HTTP Listeners->Http Listener 2->SSL then uncheck the box for TLS and click save. If versions above TLS1.0 are available then they should be listed there and checked.

Alternatively run the asadmin command set configs.config.server-config.network-config.protocols.protocol.http-listener-2.ssl.tls-enabled=false .

NB I do not know if GlassFish 3.1.2 supports TLS 1.1 or later, but GlassFish 4 later does.

---