how to control cipher suites in web logic 12c - ssl

Question

I am new to SSL/TLS topics, but I need to test the scenario where application deployed on WebLogic 12c (client machine, so to speak) communicates with the SOAP service deployed on WebLogic 12c (server machine). I need to make sure that specific cipher suites are used for this communication. In this regard, I have 2 questions:
Is there a way to set the specific cipher suite in the system properties on the server machine (by setting EXTRA_JAVA_PROPERTIES in one of the startup scripts) to make it choose this cipher suite to communicate to a client machine? If this is not how it can be done, can it be done at all and how?
I can see a lot of cipher suites in the ClientHello message sent by the client machine during the handshake, however when I execute nmap against this machine (nmap -sV --script ssl-enum-ciphers -p port_number machine_name), only a subset of the cipher suites from the ClientHello message is reported. Why? What is the source of truth here? ClientHello message or the result of the above mentioned nmap command?

Answer 1

Ok, I found the answer myself. In order to force the server (WebLogic12c in the above scenario) to choose very specific cipher suite to use in the handshake with the client, you will need to modify $DOMAIN_HOME/config/config.xml file. Search for ssl element and modify it for a server where your service is deployed to (either Admin or managed server). Re-boot WLS after that.
<server>
<name>AdminServer</name>
<ssl>
<name>AdminServer</name>
<enabled>true</enabled>
<ciphersuite>SSL_RSA_WITH_RC4_128_SHA</ciphersuite>
<listen-port>7002</listen-port>
...
</ssl>