title: How does removing 3DES_EDE_CBC from java.security file allow HTTPS calls to server with RC4-MD5 cipher?
body: <p>When a java 8 client code using Apache HttpClient called a https server we saw following error.</p>
  
  <pre><code>javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1002)
      at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
      at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:573)
      at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:557)
      at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:414)
      at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:180)
      at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:326)
      at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610)
      at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445)
      at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:835)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108)
      at HttpClient.main(HttpClient.java:64)
  Caused by: java.io.EOFException: SSL peer shut down incorrectly
          at sun.security.ssl.InputRecord.read(InputRecord.java:505)
          at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:983)
          ... 14 more
  </code></pre>
  
  <p>It was found that the server had RC4-MD5 cipher and since this was not supported in Java 8, this error occurred.
  Here is the result after running "openssl s_client -tls1 -connect :443" on the target https server.</p>
  
  <pre><code>New, TLSv1/SSLv3, Cipher is RC4-MD5
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  No ALPN negotiated
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : RC4-MD5
  </code></pre>
  
  <p>So I edited the jdk.tls.disabledAlgorithms property in "java.secuity" file in JVM. I removed the option '3DES_EDE_CBC' from this entry. </p>
  
  <p>Old property value:</p>
  
  <pre><code>jdk.tls.disabledAlgorithms=SSLv3, MD5withRSA, DH keySize &lt; 1024, \
      EC keySize &lt; 224, DES40_CBC_40, 3DES_EDE_CBC
  </code></pre>
  
  <p>Edited property value:</p>
  
  <pre><code>jdk.tls.disabledAlgorithms=SSLv3, MD5withRSA, DH keySize &lt; 1024, \
      EC keySize &lt; 224, DES40_CBC_40
  </code></pre>
  
  <p>After editing the java.security file, the Java HTTPS call worked.</p>
  
  <p><strong>Question:</strong> How does removing the '3DES_EDE_CBC' alogrithm from disabled algorithms allow this HTTPS call to work? How can I understand this better? Thanks.</p>