com.typesafe:ssl-config-core_3

SSL Config

Goal and purpose of this library is to make Play WS library "secure by default". Sadly, while Java's security has been steadily improving some settings are still left up to the user, and certain algorithms which should never be used in a serious production system are still accepted by the default settings of the SSL/TLS infrastructure. These things are possible to fix, by providing specialized implementations and/or defining additional settings for the Java runtime to use – this is exactly the purpose of SSL Config.

Additional modules offer integration with Play WS (which by default utilises Async Http Client), Akka Http and any other library which may need support from this library.

Versions

The project is maintained on two branches:

• main which requires Java 8 and is used by Akka 2.5.x and later.
• release-0.1 which is Java 6 compatible (does lots of manual improvements and checks that JDK6 didn't). Currently only the legacy version of Akka Streams & Http (which is 2.0.x) uses this version.

State of this project

ssl-config at this point in time is used primarily internally in Play WS, and is being evolved towards being "the place" one configures all possible SSL/TLS related settings, mostly focused on the client side of things.

The project is hosted externally of Play, in order to foster convergence and re-use of the more tricky bits of configuring TLS.

Binary compatibility is not guaranteed between versions (in the 0.x.z series) of ssl-config at this point in time. We aim to stabilise the APIs and provide a stable release eventually.

Documentation

Docs are available on: https://lightbend.github.io/ssl-config

Recommended reading

An excellent series by Will Sargent about making Play WS (from which this library originates) "secure by default":

• Fixing the Most Dangerous Code in the World
• Fixing X.509 Certificates
• Fixing Certificate Revocation
• Fixing Hostname Verification
• Testing Hostname Verification

License

Lightbend 2015-2025, Apache 2.0