java - Chrome/Firefox and Jetty HTTPS -

i have application running on jetty 6 accessed on https. connecting ie 11 works not firefox 43 or google 40. ssl trace shows jetty , browser fail find common cipher:

   %% initialized:  [session-13, ssl_null_with_null_null]    %% invalidated:  [session-13, ssl_null_with_null_null]    783842035@qtp-1833323686-4, send tlsv1.2 alert:  fatal, description = handshake_failure    783842035@qtp-1833323686-4, write: tlsv1.2 alert, length = 2    [raw write]: length = 7    0000: 15 03 03 00 02 02 28                               ......(    783842035@qtp-1833323686-4, called closesocket()    783842035@qtp-1833323686-4, handling exception: javax.net.ssl.sslhandshakeexception: no cipher suites in common 

however, when ie 11 used selected cipher tls_dhe_dss_with_aes_128_cbc_sha256:

    %% initialized:  [session-30, ssl_null_with_null_null]     %% negotiating:  [session-30, tls_dhe_dss_with_aes_128_cbc_sha256]     *** serverhello, tlsv1.2 

since chrome warns rc4 ciphers when fails connect:

a secure connection cannot established because site uses >>unsupported protocol or cipher suite. caused when >>server needs rc4, no longer considered secure.

i have excluded rc4 in java.security adding following property

    jdk.tls.disabledalgorithms=rc4 

but no avail, chrome , ff still fail connect. i've ran out of ideas. suggestions? tia.

jetty 6 long ago eol (end of life).

if stick jetty 6, know level of ssl/tls tweaking need not present in version of jetty.

you'll either have stick jvm level tweaks, or write custom sslselectchannelconnector (sorry, easier sslcontextfactory concepts introduced in jetty 7) implementation of own accomplish necessary includes , excludes of ciphers , protocols, along new tls ciphers ordering requirements pull off reliably.

jetty 9.3.7.v20160115 almost date recent , upcoming browser changes. next release, 9.3.8, have remaining tweaks necessary support recent browser changes, under java 8u72 (or newer).

also of note, since have ssl/tls enabled on jetty, have keep version of java date, if no other reason keep changes in ssl/tls on past few years.