Goal and purpose of this library is to make Play's WS library as well as Akka HTTP "secure by default". Sadly, while Java's security has been steadily improving some settings are still left up to the user, and certain algorithms which should never be used in a serious prodution system are still accepted by the default settings of the SSL/TLS infrastructure. These things are possible to fix, by providing specialized implementations and/or defining additional settings for the Java runtime to use – this is exactly the purpose of SSL Config.
Additional modules offer integration with Play WS (which by default utilises the Ning Async Http Client), Akka Http and any other library which may need support from this library.
The project is maintained on two branches:
masterwhich requires Java 8 and is used by Akka2.4.x.release-0.1which is Java 6 compatible (does lots of manual improvements and checks that JDK6 didn't). Currently only the legacy version of Akka Streams & Http (which is2.0.x) uses this version.
Latest versions:
// JDK8:
"com.typesafe" %% "ssl-config-akka" % "0.2.1"
// JDK6/7 (some features may be backported here)
"com.typesafe" %% "ssl-config-akka" % "0.1.3"
ssl-config at this point in time is used primarily internally in Akka HTTP, and is being evolved towards being "the place" one configures all possible SSL/TLS related settings, mostly focused on the client side of things.
The project is hosted externally of either Akka or Play, in order to foster convergence and re-use of the more tricky bits of configuring TLS.
Binary compatibility is not guaranteed between versions (in the 0.x.z series) of ssl-config at this point in time.
We aim to stabilise the APIs and provide a stable release eventually.
Docs are available on: https://lightbend.github.io/ssl-config
An excellent series by Will Sargent about making Play's WS (from which this library originates) "secure by default":
- Fixing the Most Dangerous Code in the World
- Fixing X.509 Certificates
- Fixing Certificate Revocation
- Fixing Hostname Verification
- Testing Hostname Verification
Lightbend 2015-2016, Apache 2.0