title: Restricting Java based Web Server TLS protocols for inspection by Wireshark
body: <p>I am using a Java based Web Server ( PlayFramework 2.2 FWIW - see the <a href="http://tersesystems.com/2014/01/13/fixing-the-most-dangerous-code-in-the-world/" rel="nofollow noreferrer">very good write up on TLS</a> ), and I want to debug the SSL communication for various devices, eg: Android, to see exactly what is happening on the wire as far as TLS goes. For this I can use <a href="http://wiki.wireshark.org/SSL" rel="nofollow noreferrer">Wireshark to decrypt the SSL layer</a>. This works if the server does not create an Ephemeral key, as <a href="http://packetpushers.net/using-wireshark-to-decode-ssltls-packets/" rel="nofollow noreferrer">explained nicely by Steven Iveson</a>:</p>
  
  <blockquote>
    <p>Important: Ensure the use of a Diffie-Hellman Ephemeral (DHE/EDH) or
    RSA Ephemeral cipher suite is not negotiated between the two hosts.
    This is indicated by the use of a ServerKeyExchange message. There is
    no way to decrypt data where ephemeral ciphers are used.</p>
  </blockquote>
  
  <p>The <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html#DisabledAlgorithms" rel="nofollow noreferrer">Java Secure Sockets Extension Reference Guide section on how to Disable Algorithms</a> points to the <code>jdk.tls.disabledAlgorithms</code> property which I have tried setting directly in the <code>$JAVA_HOME/jre/lib/security/java.security</code> file to </p>
  
  <pre><code>jdk.tls.disabledAlgorithms=DH, ECDH, EDCHE, DiffieHellman
  </code></pre>
  
  <p>I tried using some of the <a href="http://docs.oracle.com/javase/7/docs/technotes/guides/security/StandardNames.html" rel="nofollow noreferrer">Java™ Cryptography Architecture
  Standard Algorithm Name Documentation</a> as an attempt to select one of those strings, but I have been selecting a bit in the wild.</p>
  
  <p>I tried setting it also using it in code to </p>
  
  <pre><code>java.security.Security.setProperty("jdk.tls.disabledAlgorithms","ECDH, ECDHE, ECDHE_RSA, DiffieHellman")
  </code></pre>
  
  <p>but that does not seem to stop the  the appearance of the <code>ServerKeyExchange</code> messages, as shown in the screenshot of Wireshark 1.11.2 on OSX: <img src="https://i.stack.imgur.com/KswZH.png" alt="screenshot of Wireshark 1.11.2 on OSX"> . And indeed I don't seem to be able to decrypt the stream.</p>
  
  <p>Any idea what I may be doing wrong?</p>