Windows10下IE11访问应用提示“无法安全连接”问题咨询

Hey there, let's break down this compatibility issue you're facing. The core problem boils down to Windows 10's IE11 having stricter default security rules compared to Windows 7's IE11—specifically, it disables older TLS protocols like TLS 1.0/1.1 by default, while your Embedded Jetty setup (running on Java 8u66) might not be configured to use the newer, supported TLS 1.2. Here's how to resolve it step by step:

1. Update Jetty's TLS Configuration to Support TLS 1.2 #

Java 8u66 does support TLS 1.2, but Jetty doesn't enable it by default. You'll need to explicitly configure your server to prioritize modern TLS protocols and disable outdated ones.

Example for Embedded Jetty (Programmatic Setup): #

Add this configuration when initializing your SSL context:

import org.eclipse.jetty.util.ssl.SslContextFactory;

// Initialize SSL context factory
SslContextFactory sslContextFactory = new SslContextFactory();

// Enable only TLS 1.2 (the minimum supported by Windows 10 IE11)
sslContextFactory.setIncludeProtocols("TLSv1.2");
// Disable unsafe/outdated protocols
sslContextFactory.setExcludeProtocols("SSLv3", "TLSv1", "TLSv1.1");

// Configure secure cipher suites (avoid weak or deprecated ones)
sslContextFactory.setIncludeCipherSuites(
    "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
    "TLS_RSA_WITH_AES_128_GCM_SHA256",
    "TLS_RSA_WITH_AES_256_GCM_SHA384"
);

// Attach this factory to your Jetty server connector
ServerConnector sslConnector = new ServerConnector(server, sslContextFactory);
// Set your SSL port and other connector settings as needed

Example for Jetty XML Configuration: #

Modify or add the <SslContextFactory> section in your jetty.xml:

<New class="org.eclipse.jetty.util.ssl.SslContextFactory">
  <Set name="includeProtocols">
    <Array type="java.lang.String">
      <Item>TLSv1.2</Item>
    </Array>
  </Set>
  <Set name="excludeProtocols">
    <Array type="java.lang.String">
      <Item>SSLv3</Item>
      <Item>TLSv1</Item>
      <Item>TLSv1.1</Item>
    </Array>
  </Set>
  <!-- Add cipher suite configuration here if needed -->
</New>

2. Verify Windows 10 IE11's TLS Settings #

Double-check that IE11 is set to use TLS 1.2 (it should be default, but confirm):

• Open IE11, click the gear icon → Internet Options
• Navigate to the Advanced tab
• Scroll to the Security section
• Ensure Use TLS 1.2 is checked, and uncheck Use TLS 1.0 and Use TLS 1.1 once your Jetty server is configured for TLS 1.2.

3. Ensure Silverlight is Enabled and Compatible #

Windows 10's IE11 has tighter restrictions on Silverlight:

• Update Silverlight to the latest available version (even though it's end-of-life, newer patches fix Windows 10 compatibility gaps)
• Enable the Silverlight plugin: Gear icon → Manage add-ons → Find Microsoft Silverlight → Set to Enabled
• Add your app's URL to IE11's Compatibility View Settings: Gear icon → Compatibility View Settings → Enter your site URL and click Add

4. Test Jetty's TLS Support #

To confirm your server is now supporting TLS 1.2, use the OpenSSL command line tool (if available):

openssl s_client -connect your-server-domain:your-ssl-port -tls1_2

If the connection succeeds and you see the server's certificate details, your TLS 1.2 configuration is working.

内容的提问来源于stack exchange，提问作者adithya