{"record":{"id":"7423b77f2af2409d","repo":"pinpoint-apm/pinpoint","slug":"ciphersuite-is-not-safe-please-check-this-url-h","errorCode":null,"errorMessage":"cipherSuite+ is not safe. Please check this url.(https://httpwg.org/specs/rfc7540.html#BadCipherSuites)","messagePattern":"cipherSuite\\+ is not safe\\. Please check this url\\.\\(https://httpwg\\.org/specs/rfc7540\\.html#BadCipherSuites\\)","errorType":"validation","errorClass":"SSLException","httpStatus":null,"severity":"error","filePath":"grpc/src/main/java/com/navercorp/pinpoint/grpc/security/SslContextFactory.java","lineNumber":121,"sourceCode":"\n        sslContextBuilder.protocols(SecurityConstants.DEFAULT_SUPPORT_PROTOCOLS.toArray(new String[0]));\n        sslContextBuilder.ciphers(SecurityConstants.DEFAULT_SUPPORT_CIPHER_SUITE, SupportedCipherSuiteFilter.INSTANCE);\n\n        SslContextBuilder configure = GrpcSslContexts.configure(sslContextBuilder, sslProvider);\n        return configure.build();\n    }\n\n    private void assertValidCipherSuite(SslContext sslContext) throws SSLException {\n        Objects.requireNonNull(sslContext, \"sslContext must not be null\");\n\n        List<String> supportedCipherSuiteList = sslContext.cipherSuites();\n        if (CollectionUtils.isEmpty(supportedCipherSuiteList)) {\n            throw new SSLException(\"cipherSuites must not be empty\");\n        }\n\n        for (String cipherSuite : supportedCipherSuiteList) {\n            if (SecurityConstants.BAD_CIPHER_SUITE_LIST.contains(cipherSuite)) {\n                throw new SSLException(cipherSuite + \" is not safe. Please check this url.(https://httpwg.org/specs/rfc7540.html#BadCipherSuites)\");\n            }\n        }\n\n        LOGGER.info(\"Support cipher list : {} {}\", sslContext, supportedCipherSuiteList);\n    }\n\n    SslProvider getSslProvider(String providerType) throws SSLException {\n        if (StringUtils.isEmpty(providerType)) {\n            return SslProvider.OPENSSL;\n        }\n\n        if (SslProvider.OPENSSL.name().equalsIgnoreCase(providerType)) {\n            return SslProvider.OPENSSL;\n        }\n\n        if (SslProvider.JDK.name().equalsIgnoreCase(providerType)) {\n            return SslProvider.JDK;\n        }","sourceCodeStart":103,"sourceCodeEnd":139,"githubUrl":"https://github.com/pinpoint-apm/pinpoint/blob/744c3d3075e595656abb1ae331ad2c0e4c9eb996/grpc/src/main/java/com/navercorp/pinpoint/grpc/security/SslContextFactory.java#L103-L139","documentation":"assertValidCipherSuite iterates the SslContext's cipher suites and throws SSLException naming the suite if it appears in SecurityConstants.BAD_CIPHER_SUITE_LIST (the RFC 7540 blacklisted ciphers). The RFC 7540 spec bans weak ciphers like NULL, RC4, DES, and certain CBC suites for HTTP/2, so this factory refuses to build a server TLS context containing them.","triggerScenarios":"Calling SslContextFactory.forServer with an SslProvider (typically the JDK provider with permissive defaults or legacy crypto policy) whose supported cipher list includes a blacklisted suite such as TLS_NULL_WITH_NULL_NULL, TLS_RSA_WITH_DES_CBC_SHA, or an RC4/CBC suite.","commonSituations":"Running an old JDK or a JVM with legacy crypto policy that still advertises weak ciphers; explicit cipher whitelist config that includes RFC 7540 bad ciphers; JDK provider where OpenSSL provider would filter them out.","solutions":["Upgrade the JDK / modernize java.security crypto policy so weak ciphers are removed from supported suites.","Switch the SSL provider to OPENSSL (netty-tcnative), which excludes the bad suites.","Restrict the configured cipher suite list to only modern suites (e.g. ECDHE+AESGCM, TLS 1.2/1.3 suites).","Check the log line 'Support cipher list' to see the offending suite and remove it from configuration."],"exampleFix":"// before\ncipherSuites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256\n// after\ncipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384","handlingStrategy":"validation","validationCode":"List<String> suites = Arrays.asList(sslParameters.getCipherSuites());\nList<String> bad = List.of(\"TLS_RSA_WITH_DES_CBC_SHA\", \"TLS_RSA_WITH_NULL_SHA256\", \"*_RC4_*\");\nboolean hasWeak = suites.stream().anyMatch(s -> bad.stream().anyMatch(b -> s.contains(b.replace(\"*\", \"\"))));\nif (hasWeak) { throw new IllegalStateException(\"Weak ciphers enabled for gRPC TLS\"); }","typeGuard":null,"tryCatchPattern":"try {\n    sslContext = SslContextFactory.forServer(...);\n} catch (SSLException e) {\n    if (e.getMessage().contains(\"is not safe\")) {\n        LOG.error(\"Remove the blacklisted cipher reported: {}\", e.getMessage());\n    }\n    throw e;\n}","preventionTips":["Explicitly whitelist only modern AEAD suites (ECDHE+AES-GCM, TLS 1.3).","Run on a current JDK with modern java.security defaults that exclude RFC 7540 bad ciphers.","Prefer the OPENSSL netty provider, which filters weak suites by default."],"tags":["grpc","ssl","weak-cipher","security"],"backgroundTag":"invalid-config-value","analyzedSha":"744c3d3075e595656abb1ae331ad2c0e4c9eb996","analyzedAt":"2026-09-07T18:48:45.289Z","contentChangedAt":"2026-09-07T18:48:45.289Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}