Jetty ignores excluded cipher list when using async I/O

Using Jetty in a project at my place of work we excluded weak ciphers with a section like the following:

<Configure id="Server" class="org.eclipse.jetty.server.Server">
<!-- if NIO is not available, use org.eclipse.jetty.server.ssl.SslSocketConnector -->
<Call name="addConnector">
<Arg>
<New class="org.eclipse.jetty.server.ssl.SslSelectChannelConnector">
<Set name="Port"><SystemProperty name="webserver.port.https" default="8443"/></Set>
<Set name="maxIdleTime">30000</Set>
<Set name="Acceptors">2</Set>
<Set name="AcceptQueueSize">100</Set>
<Set name="Keystore"><SystemProperty name="mysecurity.config.home" />/config/.webserverkeystore.jks</Set>
<Set name="Password">password</Set>
<Set name="truststore"><SystemProperty name="mysecurity.config.home" />/config/.webserverkeystore.jks</Set>
<Set name="trustPassword">password</Set>
<!-- Only enable strong ciphers. -->
<Set name="ExcludeCipherSuites">
<Array type="java.lang.String">
<Item>TLS_RSA_WITH_AES_256_CBC_SHA</Item>
<Item>TLS_ECDH_ECDSA_WITH_RC4_128_SHA</Item>
<Item>TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA</Item>
<Item>TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA</Item>
<Item>TLS_ECDH_RSA_WITH_RC4_128_SHA</Item>
<Item>TLS_ECDH_RSA_WITH_AES_128_CBC_SHA</Item>
snip
<Item>TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5</Item>
</Array>
</Set>
</New>
</Arg>
</Call>
</Configure>

In running some tests against the service, though, it appears that all kinds of ciphers are available that are not only medium or low strength, but even the null ciphers are showing up as options (they are also excluded in the snipped out section). I am told by one of the developers that we are using async (NIO) and I see the comment at the top of the XML configuration, but this should be available. Still, switching the fifth line to use org.eclipse.jetty.server.ssl.SslSocketConnector appears to work correctly in that the weak/low/null ciphers are no longer allowed.

I have searched the changelog for Jetty, as well as open issues, and see nothing for this. The note above makes me think this could be a configuration error, but the developer involved is thorough so I am inclined to trust him. If there are any words of advice to help me narrow this down, or if there are specific tests I can do to verify this one way or another, I'm open to running others' code for that purpose (sadly, I am not a great programmer). The tests of available cipher suites originally came from Nessus but have been verified with tests done using openssl. One result of this issue is that products which should be secure can be tricked to do things insecurely on the wire, including using null ciphers.

Reproducible: All of our systems implementing Jetty the same way exhibit the symptom of allowing what we believe are excluded cipher suites when using NIO.

Expected Results: Excluded cipher suites should be excluded.

Actual Results: Excluded cipher suites list appears to make no difference to the running service's available/used cipher suites.