We have an Apache server that depolys a Tomcat Web app. With our lattest build, we have found that the set for SSL ciphers that the server is willing to accpet has become much more restrictive. Specifically it has gone from the first list below to the second.

I have checked for changes in the following but everything seem identical:

• sever.xml
• httpd-ssl.conf
• security.properties
• java version (openjdk 17.0.10 2024-01-16)
• 3rd party dependencies

The only change I have found is in the Tomcat version:

Server version: Apache Tomcat/9.0.86
Server built:   Feb 14 2024 08:15:12 UTC
Server number:  9.0.86.0

Server version: Apache Tomcat/9.0.88
Server built:   Apr 9 2024 13:22:30 UTC
Server number:  9.0.88.0

There seems to be no pattern in the excluded ciphers vs the included (both have LTS v1.0 and v1.2) apart from the fact that it is only including ciphers that are elliptical curve.

What am I missing that could explain this change is behavior? We are still passing in the same list of ciphers in the conf files.

From:

DHE-RSA-AES128-SHA
DHE-RSA-AES128-SHA256
DHE-RSA-AES256-GCM-SHA384
DHE-RSA-AES256-SHA
DHE-RSA-AES256-SHA256
ECDHE-RSA-AES128-SHA
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES256-SHA
ECDHE-RSA-AES256-SHA384

To:

ECDHE-RSA-AES256-SHA384
ECDHE-RSA-AES128-SHA256
ECDHE-RSA-AES256-SHA
ECDHE-RSA-AES128-SHA