Disabling SSL2 in WebLogic 10.3 not working correctly

Question

Hey,
I am trying to disable SSLv2 completely within WebLogic and am using the information contained here (http://download.oracle.com/docs/cd/E12840_01/wls/docs103/secmanage/ssl.html#wp1194346) and have specifically sure I'm using jsafeFIPS.jar and the "-Dweblogic.security.SSL.nojce=true" argument. I want to allow ONLY TLS and SSLv3 communication. Unfortunately, when I attempt to test this setup by forcing my browser to attempt a connection over SSL2 (and any available cipher), WebLogic will still allow me to initiate a connection and exchange certificates. To be clear, that means the packet flow looks like this when I try https://server/:
ME-SERVER: SYN
SERVER-ME: SYN,ACK
ME-SERVER: ACK
(the stuff above is just the TCP stream initiation)
ME-SERVER: SSLv2 Client Hello (with my list of ciphers in here of course)
SERVER-ME: ACK
SERVER-ME: SSLv2 Server Hello (and it shows 2 cipher specs -- in the SSL2 space, and it provides my certificate)
ME-SERVER: ACK
ME-SERVER: SSLv2 Client Master Key (I choose to use one of the ciphers we both have)
SERVER-ME: ACK
(the stuff below is the tear down of the TCP stream)
SERVER-ME: FIN,ACK
ME-SERVER: ACK
ME-SERVER: FIN,ACK
The problem here is that I don't want WebLogic to walk down the path of offering ciphers it knows it will immediately reject. And I'd prefer it not even respond when SSLv2 hellos are offered. I'm lost at this point -- is this something WebLogic can do?

Answer 1

I just wanted to add one more thing here: the functionality on the SSL-based node manager is even worse. Here's how that packet flow appears. The thing to focus on here is that the tear down of the TCP stream is actually initiated by me and not by the server. I'm using a browser to test this, so it looks like the browser is trying to make something happen and then timing out. To be clear, it takes me almost exactly 30 seconds before I tear down my side of this TCP session (probably a timeout).
ME-SERVER: SYN
SERVER-ME: SYN,ACK
ME-SERVER: ACK
(the stuff above is just the TCP stream initiation)
ME-SERVER: SSLv2 Client Hello (with my list of ciphers in here of course)
SERVER-ME: ACK
SERVER-ME: SSLv2 Server Hello (and it shows 2 cipher specs -- in the SSL2 space, and it provides my certificate)
ME-SERVER: ACK
ME-SERVER: SSLv2 Client Master Key (I choose to use one of the ciphers we both have)
SERVER-ME: ACK
(the stuff below is the tear down of the TCP stream)
ME-SERVER: FIN,ACK
SERVER-ME: ACK
SERVER-ME: FIN,ACK
ME-SERVER: ACK