Scala : Unsafe SSL configuration

SSL connection uses insecure settings. The established connection is insecure and can cause a compromise of valuable data.

In Java applications constants that denote the cipher suite are used to set the parameters of SSL connection. Many cipher suits are insecure, obsolete or artificially weakened due to export restrictions. Some secure cipher suites:

• TLS_DHE_RSA_WITH_AES_128_CBC_SHA
• SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_RSA_WITH_AES_128_CBC_SHA
• SSL_RSA_WITH_3DES_EDE_CBC_SHA
• TLS_DHE_DSS_WITH_AES_128_CBC_SHA
• SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA

In the Play Framework the SSLLooseConfig class is used to create a potentially insecure SSL connection for testing purposes. The true values for the following parameter makes the connection insecure: acceptAnyCertificate, allowWeakCiphers, disableHostnameVerification, allowWeakProtocols, allowUnsafeRenegotiation. Do not use SSLLooseConfig in real applications.