TLSv1.3 TLS CipherSuites

[andrea...@atsmed.it]

I'm using dcm4chee-arc 5.43.3 secure with docker.

From about:
J4Care
SMooTH Archive
Version 5.34.3,88f14a1,2026-03-18

I was testing TLS and i have seen that from network connection extension in dicom-tls that TLSv1.3 is available but there is no an appropriate TLS CipherSuites in network connection attribute.

I tried with openssl and connection is correctly handshaked with TLSv1.3 but no  CipherSuitesis can be negotiated.

I tried adding a supported CipherStuite manually directly in LDAP configuration and after that negotiation works properly.

Now my question is: is this list hardcoded somewhere or it can be edited in some way?

TLS CipherSuites:
SSL_RSA_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_NULL_SHA
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
TLS_RSA_WITH_AES_128_CBC_SHA

[andrea...@atsmed.it]

 Ok, it's in networkConnection.schema.json in each language.

Security TLS configuration (SunJSSE provider):
Enabled Protocols:
TLSv1.3
TLSv1.2
TLSv1.1
TLSv1

Enabled Cipher Suites:
TLS_AES_256_GCM_SHA384 (TLSv1.3)
TLS_AES_128_GCM_SHA256 (TLSv1.3)
TLS_CHACHA20_POLY1305_SHA256 (TLSv1.3)
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 (TLSv1.2)
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (TLSv1.2)
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 (TLSv1.2)
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (TLSv1.2)
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (TLSv1.2)
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 (TLSv1.2)
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 (TLSv1.2)
TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (TLSv1.2)
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 (TLSv1.2)
TLS_RSA_WITH_AES_128_CBC_SHA (TLSv1.1 and TLSv1)

To enable TLS1.0 and TLS1.1 protocols follow this guide and use JAVA_OPTS to execute wildfly with required options.
https://aws.amazon.com/blogs/opensource/tls-1-0-1-1-changes-in-openjdk-and-amazon-corretto/

I did not find a way to enable  SSLv3

I think it would be better to add the CipherSuite above in order to be able to really enable TLSv1, TLSv1.1, TLSv1.2, TLSv1.3 or remove  TLSv1, TLSv1.1, and SSLv3.