| At line 1 changed one line |
| The policy files must be downloaded manually and installed in your Java lib/security folder replacing the old files. (DO NOT KEEP THE OLD FILES. Keeping both will invalidate the install. Replace the old ones.) |
| Install video showing these steps: [https://youtu.be/SiEK5hZ09JI] |
| At line 3 changed 4 lines |
| Java6: http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html \\ |
| Java7: http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html \\ |
| Java8: http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html \\ |
| You may also search google for: 'java unlimited cryptography policy files'\\ |
| The policy files must be downloaded manually and installed in your Java lib/security/policy/limited/ and lib/security/policy/unlimited/ folder replacing the old files. (DO NOT KEEP THE OLD FILES. Keeping both will invalidate the install. Replace the old ones.) |
| At line 8 changed 2 lines |
|
| OS X Java 6 install location:\\ |
| [attachments|oracle.png]\\ |
| \\ |
| (If you are unsure which java version you are using, look at the about tab on the admin console.)\\ |
| \\ |
| Java6: [http://www.oracle.com/technetwork/java/javase/downloads/jce-6-download-429243.html] \\ |
| Java7: [http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html] \\ |
| Java8: [http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html] \\ |
| \\ |
| You may also search google for: 'java unlimited cryptography policy files'\\ |
| \\ |
| OS X Java 6 install location: |
| At line 13 changed one line |
| OS X Java 7 and above install location:\\ |
| OS X Java 7 and above install location: |
| At line 15 changed one line |
| /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/ |
| /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/policy/limited/ |
| and |
| /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/security/policy/unlimited/ |
|
| At line 17 changed one line |
| Windows install location:\\ |
| Windows install location: |
| At line 19 changed one line |
| C:\Program Files\Java\jre8\lib\security\ |
| C:\Program Files\Java\jre1.8.0_xx\lib\security\policy\limited\ |
| and |
| C:\Program Files\Java\jre1.8.0_xx\lib\security\policy\unlimited\ |
| or at |
| C:\Program Files (x86)\Java\jre1.8.0_xx\lib\security\policy\limited\ |
| and |
| C:\Program Files (x86)\Java\jre1.8.0_xx\lib\security\policy\unlimited\ |
| At line 22 changed one line |
| CrushFTP must be restarted after making this change. (The service or daemon.) You can use the CrushFTP app to stop the daemon, and start the daemon.\\ |
| [attachments|windows.png]\\ |
| [attachments|replace.png]\\ |
| At line 24 changed 2 lines |
| Once this has been done, edit the cipher list in the server prefs SSH port item, SSH tab to duplicate the AES128 ciphers and replace the 128 with 256. Your Encryption, SSL tab items will automatically include the new items. Stronger key and keystore files will now work properly too. You will now be secure using strong cryptography instead of the weakened default policy that ships with Java due to 1990's bureaucracy.\\ |
|
| CrushFTP must be restarted after replacing the two jar files. (The service or daemon.) You can use the CrushFTP app to stop the daemon, and start the daemon.\\ |
| \\ |
| !!Optional additional steps for SSH:\\ |
| Once this has been done, edit the cipher list in the server prefs SSH port item, SSH tab to duplicate the AES128 ciphers and replace the 128 with 256.\\ |
| At line 28 changed one line |
| The updated files will resolve PGP decryption issues, outbound SFTP/FTPES/HTTPS/SMTP connection issues to servers requiring strong cryptography, etc. Anything requiring strong cryptography will now work! |
| \\ |
| !!Optional additional steps for SSL/TLS:\\ |
| Your Encryption, SSL tab items will automatically include the new items, but click the disable insecure ciphers to remove any additional weak ciphers. Stronger key and keystore files will now work properly too.\\ |
| \\ |
| \\ |
| !!What this Resolves\\ |
| The updated files will resolve PGP decryption issues, outbound SFTP/FTPES/HTTPS/SMTP connection issues to servers requiring strong cryptography, etc. Anything requiring strong cryptography will now work!\\ |
|
| In the admin > Preferences > Encryption > SSL tab you can set select the "All insecure ciphers" and that will automatically remove the weak encryption files. After this change, either restart the HTTPS port, or restart the CrushFTP service / daemon again. |
| \\ |
| [attachments|all_insecure.png] |
