Skip to content

[BUG] SSLContext hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths #76

Closed

Description

@jetersen

Describe the bug

Rest and SslConfig both hardcode SSLContext.getInstance("TLSv1.2"), which caps TLS negotiation at 1.2 and prevents connections to servers that require TLS 1.3.

  • Rest.DISABLED_SSL_CONTEXT (static initializer): used when sslVerification=false
  • SslConfig.buildSslContextFromJks() / buildSslContextFromPem(): used when a custom trust store or PEM cert is configured.

Both should use SSLContext.getInstance("TLSv1.3") so the JVM negotiates the highest mutually supported version (1.2 or 1.3). Or at the very least support both TLSv1.2 and TLSv1.3 via SSLParameters(["TLSv1.2","TLSv1.3"]) since both TLSv1 and TLSv1.1 are considered insecure.

To Reproduce

  1. Configure a server (e.g. HashiCorp Vault) with tls_min_version = "tls13"
  2. Connect using vault-java-driver 6.x with either:
  • SslConfig().verify(false) (skip SSL verification), or
  • SslConfig().trustStoreFile(...) / SslConfig().pemFile(...) (custom CA cert)
  1. Observe javax.net.ssl.SSLHandshakeException: (protocol_version) Received fatal alert: protocol_version

Expected behavior
Driver negotiates TLS 1.3 when the server requires it. Changing SSLContext.getInstance("TLSv1.2") to SSLContext.getInstance("TLS") in both locations restores standard JVM protocol negotiation (TLS 1.2 and 1.3).

Activity

  1. changed the title [-][BUG] SSLContext hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths[/-] [+][BUG] `SSLContext` hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths[/+] on May 28, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions