You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
[BUG] SSLContext hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths #76
Rest and SslConfig both hardcode SSLContext.getInstance("TLSv1.2"), which caps TLS negotiation at 1.2 and prevents connections to servers that require TLS 1.3.
Rest.DISABLED_SSL_CONTEXT (static initializer): used when sslVerification=false
SslConfig.buildSslContextFromJks() / buildSslContextFromPem(): used when a custom trust store or PEM cert is configured.
Both should use SSLContext.getInstance("TLSv1.3") so the JVM negotiates the highest mutually supported version (1.2 or 1.3). Or at the very least support both TLSv1.2 and TLSv1.3 via SSLParameters(["TLSv1.2","TLSv1.3"]) since both TLSv1 and TLSv1.1 are considered insecure.
To Reproduce
Configure a server (e.g. HashiCorp Vault) with tls_min_version = "tls13"
Connect using vault-java-driver 6.x with either:
SslConfig().verify(false) (skip SSL verification), or
SslConfig().trustStoreFile(...) / SslConfig().pemFile(...) (custom CA cert)
Observe javax.net.ssl.SSLHandshakeException: (protocol_version) Received fatal alert: protocol_version
Expected behavior
Driver negotiates TLS 1.3 when the server requires it. Changing SSLContext.getInstance("TLSv1.2") to SSLContext.getInstance("TLS") in both locations restores standard JVM protocol negotiation (TLS 1.2 and 1.3).
changed the title [-][BUG] SSLContext hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths[/-][+][BUG] `SSLContext` hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths[/+]on May 28, 2026
Activity
[-][BUG] SSLContext hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths[/-][+][BUG] `SSLContext` hardcoded to TLSv1.2 prevents TLS 1.3 connections in skip-verify and custom cert paths[/+]