From 5d5d9149673fa6d55c76f5feb8f5e5c8f8111e5f Mon Sep 17 00:00:00 2001
From: kaido207 <kaido.hiroki@fujitsu.com>
Date: Tue, 10 Dec 2024 14:27:35 +0900
Subject: [PATCH 1/2] Disable TLS 1.0 and TLS 1.1 by default

Signed-off-by: kaido207 <kaido.hiroki@fujitsu.com>
---
 .../web/src/main/help/en/help/ref-protocolssledit.html      | 6 +++---
 .../web/src/main/help/en/help/task-protocolssledit.html     | 6 +++---
 .../src/main/java/org/glassfish/grizzly/config/dom/Ssl.java | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/appserver/admingui/web/src/main/help/en/help/ref-protocolssledit.html b/appserver/admingui/web/src/main/help/en/help/ref-protocolssledit.html
index 1d4ef625c3c..6baf178e014 100644
--- a/appserver/admingui/web/src/main/help/en/help/ref-protocolssledit.html
+++ b/appserver/admingui/web/src/main/help/en/help/ref-protocolssledit.html
@@ -1,6 +1,6 @@
 <!--
 
-    Copyright (c) 2023 Contributors to the Eclipse Foundation
+    Copyright (c) 2023, 2024 Contributors to the Eclipse Foundation
     Copyright (c) 2005, 2018 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
@@ -31,11 +31,11 @@ <h4><a id="sthref148" name="sthref148"></a><a id="sthref149" name="sthref149"></
 </dd>
 <dt>TLS1.0</dt>
 <dd>
-<p>If this checkbox is selected, the TLS1.0 protocol is enabled for the protocol. This option is enabled by default.</p>
+<p>If this checkbox is selected, the TLS1.0 protocol is enabled for the protocol. This option is not enabled by default.</p>
 </dd>
 <dt>TLS1.1</dt>
 <dd>
-<p>If this checkbox is selected, the TLS1.1 protocol is enabled for the protocol. This option is enabled by default.</p>
+<p>If this checkbox is selected, the TLS1.1 protocol is enabled for the protocol. This option is not enabled by default.</p>
 </dd>
 <dt>TLS1.2</dt>
 <dd>
diff --git a/appserver/admingui/web/src/main/help/en/help/task-protocolssledit.html b/appserver/admingui/web/src/main/help/en/help/task-protocolssledit.html
index 854562df17c..bcf23bc435d 100644
--- a/appserver/admingui/web/src/main/help/en/help/task-protocolssledit.html
+++ b/appserver/admingui/web/src/main/help/en/help/task-protocolssledit.html
@@ -1,6 +1,6 @@
 <!--
 
-    Copyright (c) 2023 Contributors to the Eclipse Foundation
+    Copyright (c) 2023, 2024 Contributors to the Eclipse Foundation
     Copyright (c) 2005, 2018 Oracle and/or its affiliates. All rights reserved.
 
     This program and the accompanying materials are made available under the
@@ -44,11 +44,11 @@ <h5>Before You Begin</h5>
 </li>
 <li>
 <p>Select the TLS1.0 Enabled checkbox to enable Transport Layer Security 1.0(TLS1.0).</p>
-<p>This option is enabled by default.</p>
+<p>This option is not enabled by default.</p>
 </li>
 <li>
 <p>Select the TLS1.1 Enabled checkbox to enable Transport Layer Security 1.1(TLS1.1).</p>
-<p>This option is enabled by default.</p>
+<p>This option is not enabled by default.</p>
 </li>
 <li>
 <p>Select the TLS1.2 Enabled checkbox to enable Transport Layer Security 1.2(TLS1.2).</p>
diff --git a/nucleus/grizzly/config/src/main/java/org/glassfish/grizzly/config/dom/Ssl.java b/nucleus/grizzly/config/src/main/java/org/glassfish/grizzly/config/dom/Ssl.java
index 534da14c818..5439b0423da 100644
--- a/nucleus/grizzly/config/src/main/java/org/glassfish/grizzly/config/dom/Ssl.java
+++ b/nucleus/grizzly/config/src/main/java/org/glassfish/grizzly/config/dom/Ssl.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2022, 2023 Contributors to the Eclipse Foundation
+ * Copyright (c) 2022, 2024 Contributors to the Eclipse Foundation
  * Copyright (c) 2009, 2020 Oracle and/or its affiliates. All rights reserved.
  *
  * This program and the accompanying materials are made available under the
@@ -38,9 +38,9 @@ public interface Ssl extends ConfigBeanProxy, PropertyBag {
 
     boolean SSL3_ENABLED = false;
 
-    boolean TLS_ENABLED = true;
+    boolean TLS_ENABLED = false;
 
-    boolean TLS11_ENABLED = true;
+    boolean TLS11_ENABLED = false;
 
     boolean TLS12_ENABLED = true;
 

From 64e48d3e8d1306c4be19e9b2cec82d1a22a0e158 Mon Sep 17 00:00:00 2001
From: kaido207 <kaido.hiroki@fujitsu.com>
Date: Tue, 10 Dec 2024 17:14:27 +0900
Subject: [PATCH 2/2] Fix ssl config test

Signed-off-by: kaido207 <kaido.hiroki@fujitsu.com>
---
 .../sun/enterprise/configapi/tests/Ssl2EnabledTest.java    | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/nucleus/admin/config-api/src/test/java/com/sun/enterprise/configapi/tests/Ssl2EnabledTest.java b/nucleus/admin/config-api/src/test/java/com/sun/enterprise/configapi/tests/Ssl2EnabledTest.java
index f4e335725e1..0f316a232db 100644
--- a/nucleus/admin/config-api/src/test/java/com/sun/enterprise/configapi/tests/Ssl2EnabledTest.java
+++ b/nucleus/admin/config-api/src/test/java/com/sun/enterprise/configapi/tests/Ssl2EnabledTest.java
@@ -1,6 +1,6 @@
 /*
  * Copyright (c) 1997, 2018 Oracle and/or its affiliates. All rights reserved.
- * Copyright (c) 2021 Contributors to the Eclipse Foundation
+ * Copyright (c) 2021, 2024 Contributors to the Eclipse Foundation
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0, which is available at
@@ -69,7 +69,10 @@ public void sslEnabledTest() {
                 assertNotNull(ssl);
                 assertFalse(Boolean.parseBoolean(ssl.getSsl2Enabled()));
                 assertFalse(Boolean.parseBoolean(ssl.getSsl3Enabled()));
-                assertTrue(Boolean.parseBoolean(ssl.getTlsEnabled()));
+                assertFalse(Boolean.parseBoolean(ssl.getTlsEnabled()));
+                assertFalse(Boolean.parseBoolean(ssl.getTls11Enabled()));
+                assertTrue(Boolean.parseBoolean(ssl.getTls12Enabled()));
+                assertTrue(Boolean.parseBoolean(ssl.getTls13Enabled()));
             },
             () -> {
                 NetworkListener listener = listeners.get(2);