How to disable desired ciphers in druid TLS/SSL configuration

Hello Group,

Can someone provide the examples on how to use cipher values for below parameters?

Our goal is to enable all cipher suits but not DES and IDEA ciphers.

We tried below configuration parameters but both are throwing an exception

druid.server.https.includeCipherSuites=ALL
druid.server.https.excludeCipherSuites=DES-CBC3-SHA:IDEA-CBC-SHA

Caused by: com.fasterxml.jackson.databind.exc.MismatchedInputException: Cannot deserialize instance of `java.util.ArrayList<java.lang.Object>` out of VALUE_STRING token
 at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apache.druid.server.initialization.TLSServerConfig["excludeCipherSuites"])

2021-09-23T04:39:06,770 INFO [main] org.apache.druid.cli.CliCoordinator - * druid.server.https.includeCipherSuites: ALL
 at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apache.druid.server.initialization.TLSServerConfig["includeCipherSuites"]).
 at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apache.druid.server.initialization.TLSServerConfig["includeCipherSuites"])
 at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apache.druid.server.initialization.TLSServerConfig["includeCipherSuites"])

2021-09-23T04:32:26,729 INFO [main] org.apache.druid.cli.CliCoordinator - * druid.server.https.excludeCipherSuites: DES-CBC3-SHA:IDEA-CBC-SHA
2021-09-23T04:32:26,729 INFO [main] org.apache.druid.cli.CliCoordinator - * druid.server.https.includeCipherSuites: ALL
 at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apache.druid.server.initialization.TLSServerConfig["excludeCipherSuites"]).
 at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apache.druid.server.initialization.TLSServerConfig["excludeCipherSuites"])
 at [Source: UNKNOWN; line: -1, column: -1] (through reference chain: org.apache.druid.server.initialization.TLSServerConfig["excludeCipherSuites"])
2021-09-23T04:32:33,139 INFO [main] org.apache.druid.cli.CliCoordinator - * druid.server.https.excludeCipherSuites: DES-CBC3-SHA:IDEA-CBC-SHA

Total guess @murakonda but is this as simple as putting the values in the config in quotes?

(Druid seems to be wanting an array but can’t get one — maybe another option is to use commas…).

Hello, welcome to guess land.