I was looking at the SSL code in CloudStack and noticed that there are about a dozen calls to the SSLContext.getInstance() method. Some of them use the "SSL" protocol while others use "TLS" or "TLSv1". So I'm wondering if it makes sense to expose a configuration setting which specifies an organization's minimum secure protocol level and then use that in all of CloudStack. Is there a need to maintain distinct protocol configurations for each SSL/TLS connection? Here's the usage list today:
plugins/hypervisors/xen/src/com/cloud/hypervisor/xen/resource/XenServerConnectionPool.java:90: javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext.getInstance("TLS"); plugins/network-elements/nicira-nvp/src/com/cloud/network/nicira/NiciraNvpApi.java:555: SSLContext sc = SSLContext.getInstance("SSL"); plugins/network-elements/palo-alto/src/com/cloud/network/utils/HttpClientWrapper.java:42: SSLContext ctx = SSLContext.getInstance("TLS"); plugins/storage/volume/solidfire/src/org/apache/cloudstack/storage/datastore/util/SolidFireUtil.java:703: SSLContext sslContext = SSLContext.getInstance("SSL"); services/console-proxy/server/src/com/cloud/consoleproxy/ConsoleProxySecureServerFactoryImpl.java:71: sslContext = SSLContext.getInstance("TLS"); services/console-proxy/server/src/com/cloud/consoleproxy/ConsoleProxySecureServerFactoryImpl.java:94: sslContext = SSLContext.getInstance("TLS"); services/console-proxy/server/src/com/cloud/consoleproxy/util/RawHTTP.java:236: sslContext = SSLContext.getInstance("SSL", "SunJSSE"); services/console-proxy-rdp/rdpconsole/src/main/java/streamer/SocketWrapper.java:130: SSLContext sslContext = SSLContext.getInstance("TLSv1"); utils/src/com/cloud/utils/nio/Link.java:430: sslContext = SSLContext.getInstance("TLS"); utils/src/org/apache/commons/httpclient/contrib/ssl/EasySSLProtocolSocketFactory.java:114: SSLContext context = SSLContext.getInstance("SSL"); vmware-base/src/com/cloud/hypervisor/vmware/util/VmwareClient.java:102: javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext.getInstance("SSL"); vmware-base/src/com/cloud/hypervisor/vmware/util/VmwareContext.java:80: javax.net.ssl.SSLContext sc = javax.net.ssl.SSLContext.getInstance("SSL");