Skip to content

fix: use TLS protocol alias to enable TLS 1.3 negotiation#77

Merged
henryx merged 1 commit into
jopenlibs:masterfrom
jetersen:fix/tls-version-negotiation
May 28, 2026
Merged

fix: use TLS protocol alias to enable TLS 1.3 negotiation#77
henryx merged 1 commit into
jopenlibs:masterfrom
jetersen:fix/tls-version-negotiation

Conversation

@jetersen
Copy link
Copy Markdown

@jetersen jetersen commented May 28, 2026

Problem

SSLContext.getInstance("TLSv1.2") hard-caps TLS negotiation at 1.2. Connections to Vault servers with tls_min_version = "tls13" fail:

javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version

fixes #76

Fix

Replace "TLSv1.2""TLSv1.3" in three places:

File Method
rest/Rest.java DISABLED_SSL_CONTEXT static initializer
SslConfig.java buildSslContextFromJks()
SslConfig.java buildSslContextFromPem()

SSLContext.getInstance("TLSv1.3") on Java 11+ (SunJSSE) enables [TLSv1.3, TLSv1.2] by default, which also drops the insecure TLS 1.0/1.1 protocols that "TLS" would otherwise include.

Test

Added testSslContextFromPemSupportsTls13 to SSLTests asserting that SslConfig built with a PEM cert produces an SSLContext supporting both TLSv1.2 and TLSv1.3.

@jetersen jetersen force-pushed the fix/tls-version-negotiation branch from 0527147 to 508089b Compare May 28, 2026 13:59
@jetersen jetersen force-pushed the fix/tls-version-negotiation branch from 508089b to b54de53 Compare May 28, 2026 14:00
@henryx henryx merged commit 888ebce into jopenlibs:master May 28, 2026
24 of 25 checks passed
@jetersen jetersen deleted the fix/tls-version-negotiation branch May 29, 2026 07:24
@jetersen
Copy link
Copy Markdown
Author

The test failure in master branch just seems like a container spawn flakey issue, @henryx

@henryx
Copy link
Copy Markdown
Collaborator

henryx commented May 29, 2026

Yes, Testcontainers initialization works correctly with Vault 1.x and fails with Vault 2.x, and for this reason I've ignored it for now. In my opinion is not a problem for the purpose of the PR, so I've preferred to merge it and check lately the reason why Vault 2.x doesn't work

@jetersen
Copy link
Copy Markdown
Author

Would a release be possible? @henryx 🙏 🙇

@henryx
Copy link
Copy Markdown
Collaborator

henryx commented May 29, 2026

Release published 😉

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[BUG] SSLContext hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths

2 participants