# Unsupported ciphers with Java and Shield
**URL:** https://discuss.elastic.co/t/unsupported-ciphers-with-java-and-shield/34487
**Category:** Elasticsearch
**Tags:** elastic-stack-security
**Created:** [November 13, 2015, 6:20am UTC](https://discuss.elastic.co/t/unsupported-ciphers-with-java-and-shield/34487 "2015-11-13T06:20:18Z")
**Posts on this page:** 4
**Page:** 1
### Author:  [@jnewmoyer](https://discuss.elastic.co/u/jnewmoyer)
#### Post date: [November 13, 2015, 6:20am UTC](https://discuss.elastic.co/t/unsupported-ciphers-with-java-and-shield/34487/1 "2015-11-13T06:20:18Z")
Using Java 1.7 with Shield to connect to our Found hosted instance using ElasticSearch 1.7.3. Getting the following stack when connecting:
ERROR 2015-11-13 06:09:56,500 [main] (AbstractSSLService.java:175) - [Saturnyne] unsupported ciphers [[TLS\_ECDHE\_RSA\_WITH\_AES\_128\_CBC\_SHA]] were requested but cannot be used
in this JVM. If you are trying to use ciphers
with a key length greater than 128 bits on an Oracle JVM, you will need to install the unlimited strength
JCE policy files. Additionally, please ensure the PKCS11 provider is enabled for your JVM.
We have installed the Unlimited Strength Cryptography jars to the JRE. But I'm unsure about PKCS11. Thanks.
---
### Author:  [@jaymode](https://discuss.elastic.co/u/jaymode)
#### Post date: [November 13, 2015, 11:55am UTC](https://discuss.elastic.co/t/unsupported-ciphers-with-java-and-shield/34487/2 "2015-11-13T11:55:51Z")
Hi Jason,
That message is a generic warning to indicate that some of the configured ciphers could not be used. Different JDK distributions enable different providers statically in the `$JAVA_HOME/jre/lib/security/java.security` file. The SunPKCS11 provider typically is the one that provides support for `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`. Which JDK are you using? OpenJDK, Oracle? Is it packaged by a linux distribution? In the past, I've been able to add the SunPKCS11 provider to the JDKs in a linux distribution and use that cipher by uncommenting the line that looks like:
```
security.provider.X=sun.security.pkcs11.SunPKCS11 ${java.home}/lib/security/nss.cfg
```
`X` above is a number that specifies the order of that provider. You will need to have `nss` libraries installed for this to work.
If you do not wish to edit the JDK files, you can specify:
```
shield.ssl.ciphers: ["TLS_RSA_WITH_AES_128_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA"]
```
This simply leaves out the unavailable cipher from the default ciphers list for Shield as specified in the [reference](https://www.elastic.co/guide/en/shield/current/reference.html).
---
### Author:  [@jnewmoyer](https://discuss.elastic.co/u/jnewmoyer)
#### Post date: [November 13, 2015, 3:57pm UTC](https://discuss.elastic.co/t/unsupported-ciphers-with-java-and-shield/34487/3 "2015-11-13T15:57:06Z")
Running on Heroku, here's our JVM:
java version "1.7.0\_79"
OpenJDK Runtime Environment (IcedTea 2.5.5) (Ubuntu build 1.7.0\_79-b14)
OpenJDK 64-Bit Server VM (build 24.79-b02, mixed mode)
Went with the path of least resistance, and defined shield.ssl.ciphers as suggested. We're up and running now. Thanks!
---
### Author:  [@system](https://discuss.elastic.co/u/system)
#### Post date: [July 6, 2017, 1:47pm UTC](https://discuss.elastic.co/t/unsupported-ciphers-with-java-and-shield/34487/4 "2017-07-06T13:47:48Z")