Workaround for "DH Keypair could not be generated"

[adambard]

Hey, this is more of an FYI than a serious pull request. I had some trouble making requests to Reddit's API from Heroku thanks to an OpenJDK issue that disallows DH SSL over 1024 bits. I came up with this workaround more-or-less based on http://stackoverflow.com/questions/10687200/java-7-and-could-not-generate-dh-keypair

I'm not sure how common this issue is, and I won't take it personally if you just close it, but I'm sending a pull for posterity anyhow.

[hiredman]

thanks for the pr. I feel a little iffy about it for three reasons:

1. disabling all DH cipher suites
2. requiring AOT compilation
3. not configurable

if you are interested in addressing those three points, that would be cool, if not I'll see if I can so no worries

[adambard]

1. Definitely, it's a sketchy workaround with narrow applicability.
2. I had some trouble getting it to play nice with proxy, but I could give it another go.
3. I don't know what other situation it would be necessary to start wholesale disabling cipher suites. Perhaps a :disable-dh-cipher-suites option accepted by core/request would be sufficient? Or perhaps just a :wrap-connection option what would let me (the user) commit whatever unadvisable connection factory mangling I want in my application code?