pinpoint-apm/pinpoint · error · SSLException

cipherSuite+ is not safe. Please check this url.(https://htt

Error message

cipherSuite+ is not safe. Please check this url.(https://httpwg.org/specs/rfc7540.html#BadCipherSuites)

What it means

assertValidCipherSuite iterates the SslContext's cipher suites and throws SSLException naming the suite if it appears in SecurityConstants.BAD_CIPHER_SUITE_LIST (the RFC 7540 blacklisted ciphers). The RFC 7540 spec bans weak ciphers like NULL, RC4, DES, and certain CBC suites for HTTP/2, so this factory refuses to build a server TLS context containing them.

Source

Thrown at grpc/src/main/java/com/navercorp/pinpoint/grpc/security/SslContextFactory.java:121

        sslContextBuilder.protocols(SecurityConstants.DEFAULT_SUPPORT_PROTOCOLS.toArray(new String[0]));
        sslContextBuilder.ciphers(SecurityConstants.DEFAULT_SUPPORT_CIPHER_SUITE, SupportedCipherSuiteFilter.INSTANCE);

        SslContextBuilder configure = GrpcSslContexts.configure(sslContextBuilder, sslProvider);
        return configure.build();
    }

    private void assertValidCipherSuite(SslContext sslContext) throws SSLException {
        Objects.requireNonNull(sslContext, "sslContext must not be null");

        List<String> supportedCipherSuiteList = sslContext.cipherSuites();
        if (CollectionUtils.isEmpty(supportedCipherSuiteList)) {
            throw new SSLException("cipherSuites must not be empty");
        }

        for (String cipherSuite : supportedCipherSuiteList) {
            if (SecurityConstants.BAD_CIPHER_SUITE_LIST.contains(cipherSuite)) {
                throw new SSLException(cipherSuite + " is not safe. Please check this url.(https://httpwg.org/specs/rfc7540.html#BadCipherSuites)");
            }
        }

        LOGGER.info("Support cipher list : {} {}", sslContext, supportedCipherSuiteList);
    }

    SslProvider getSslProvider(String providerType) throws SSLException {
        if (StringUtils.isEmpty(providerType)) {
            return SslProvider.OPENSSL;
        }

        if (SslProvider.OPENSSL.name().equalsIgnoreCase(providerType)) {
            return SslProvider.OPENSSL;
        }

        if (SslProvider.JDK.name().equalsIgnoreCase(providerType)) {
            return SslProvider.JDK;
        }

View on GitHub (pinned to 744c3d3075)

Solutions

1. Upgrade the JDK / modernize java.security crypto policy so weak ciphers are removed from supported suites.
2. Switch the SSL provider to OPENSSL (netty-tcnative), which excludes the bad suites.
3. Restrict the configured cipher suite list to only modern suites (e.g. ECDHE+AESGCM, TLS 1.2/1.3 suites).
4. Check the log line 'Support cipher list' to see the offending suite and remove it from configuration.

Example fix

// before
cipherSuites=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
// after
cipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

List<String> suites = Arrays.asList(sslParameters.getCipherSuites());
List<String> bad = List.of("TLS_RSA_WITH_DES_CBC_SHA", "TLS_RSA_WITH_NULL_SHA256", "*_RC4_*");
boolean hasWeak = suites.stream().anyMatch(s -> bad.stream().anyMatch(b -> s.contains(b.replace("*", ""))));
if (hasWeak) { throw new IllegalStateException("Weak ciphers enabled for gRPC TLS"); }

try {
    sslContext = SslContextFactory.forServer(...);
} catch (SSLException e) {
    if (e.getMessage().contains("is not safe")) {
        LOG.error("Remove the blacklisted cipher reported: {}", e.getMessage());
    }
    throw e;
}

When it happens

Trigger: Calling SslContextFactory.forServer with an SslProvider (typically the JDK provider with permissive defaults or legacy crypto policy) whose supported cipher list includes a blacklisted suite such as TLS_NULL_WITH_NULL_NULL, TLS_RSA_WITH_DES_CBC_SHA, or an RC4/CBC suite.

Common situations: Running an old JDK or a JVM with legacy crypto policy that still advertises weak ciphers; explicit cipher whitelist config that includes RFC 7540 bad ciphers; JDK provider where OpenSSL provider would filter them out.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Could not find file.(path:+filePath+)
• cipherSuites must not be empty
• can't find SslProvider. value:+providerType
• list size not same
• spanEventList is empty.

AI-assisted analysis of pinpoint-apm/pinpoint@744c3d3075 (2026-09-07). Data as JSON: /api/errors/7423b77f2af2409d. Report an issue: GitHub.