How to Change SSL Protocols (to Disable SSL 2.0/3.0) in Oracle Fusion Middleware Products (Doc ID 1936300.1)

Last updated on APRIL 29, 2024

Applies to:

Goal

How to Change SSL Protocols in Oracle Fusion Middleware Products

This document provides links to documents and other important clarifications regarding the SSL protocol configurable with Oracle Fusion Middleware products as linked in the table of contents.  You should take steps to disable older SSL protocols such as SSL 3.0 and SSL 2.0 (aka SSLv3 and SSLv2) on both servers and clients (browser settings) as these protocols are vulnerable to attacks as per the following public vulnerability:

SSL V3.0 "Poodle" Vulnerability - CVE-2014-3566 -https://www.oracle.com/technetwork/topics/security/poodlecve-2014-3566-2339408.html

Important:

• This document does not cover all Oracle Fusion Middleware (FMW) products. This document covers the integrated core FMW products requiring steps to disable SSL. To better manage popular FMW integrations, additional references will be provided once the investigation is completed in the Alert. It is important to follow the above Alert for all products you use to check their status and references provided. 
  
  
• If you are concerned about the use of specific SSL protocols to mitigate vulnerabilities, it is required to also follow the Critical Patch Update program. While the CVE-2014-3566 is a separate Alert, related fixes also entered the CPU program starting with January 2014. There are SSL/TLS fixes for previously reported issues and in some cases, patches are required to allow compatibility with newer client requirements or specific security features.
   
• Some browser clients may block and close connections seen as insecure.  If you get the errors listed below, it means you should disable SSLv2 and SSLv3 from the server. If you have verified TLS is being used and still get the error, you need to apply the CPU patches as stated in this document for the version in use in order to establish a secure connection with the client. Ensure you have the latest OPatch (<Patch 6880880>) for your version before applying CPU patches or some updates can be inadvertently skipped.
  
  

  ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION
  SSL call to NZ function nzos_Handshake failed with error 29014
  SSL call to NZ function nzos_Handshake failed with error 29049
  SSL call to NZ function nzos_Handshake failed with error 28864
  
  <Note 1955915.1> SSL Handshake Fails with ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION or SSL_ERROR_NO_CYPHER_OVERLAP Errors

Solution

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.