SpringBoot(OpenJDK11)配置TLSv1.3优先兼容TLSv1.2失败求助

环境信息 #

• 应用基于SpringBoot构建
• 使用OpenJDK 11（Temurin 11 JRE版本11.0.20.1.0+1）

问题描述 #

尝试多种方式强制配置TLS版本均未成功，JDK调试日志中出现o.apache.tomcat.util.net.SSLHostConfig的提示：

The protocol [TLSv1.2] was added to the list of protocols on the SSLHostConfig named [default]. Check if a +/- prefix is missing.

已尝试在application.properties中配置相关参数，也编写过Tomcat自定义配置类，但都没有效果。目前握手阶段日志显示应用仍在使用TLSv1.2，预期是优先使用TLSv1.3，对方服务器不支持时降级到TLSv1.2。

已尝试的application.properties配置 #

#javax.net.ssl.protocol=+TLSv1.3
#java.security.properties.jdk.tls.client.protocols=TLSv1.3,TLSv1.2
#jdk.tls.client.protocols=TLSv1.3,TLSv1.2
#management.server.ssl.enabled=true

#management.server.ssl.protocol=TLSv1.3
#server.ssl.key-store=src/main/resources/keystore.jks

#server.ssl.key-store-password=

#server.ssl.key-password=
#server.ssl.key-store-type=PKCS12
#server.ssl.trust-store=src/main/resources/truststore.jks

#server.ssl.trust-store-password=
#server.ssl.enabled=true
#server.ssl.enabled-protocols=+TLSv1.3
#server.ssl.ciphers=TLS_AES_256_GCM_SHA384,TLS_CHACHA20_POLY1305_SHA256,TLS_AES_128_GCM_SHA256
#server.tomcat.ssl.enabled-protocols=+TLSv1.3
#server.ssl.key-alias=1

握手阶段关键日志 #

2024-07-05 09:38:19.571  INFO 28872 --- [         task-1] org.hibernate.Version                    : HHH000412: Hibernate ORM core version 5.4.20.Final
javax.net.ssl|DEBUG|01|main|2024-07-05 09:38:19.571 GMT|SSLCipher.java:464|jdk.tls.keyLimits:  entry = AES/GCM/NoPadding KeyUpdate 2^37. AES/GCM/NOPADDING:KEYUPDATE = 137438953472
2024-07-05 09:38:19.756  INFO 28872 --- [         task-1] o.hibernate.annotations.common.Version   : HCANN000001: Hibernate Commons Annotations {5.1.0.Final}
javax.net.ssl|DEBUG|12|task-1|2024-07-05 09:38:19.888 GMT|HandshakeContext.java:296|Ignore unsupported cipher suite: TLS_AES_256_GCM_SHA384 for TLSv1.2
javax.net.ssl|DEBUG|12|task-1|2024-07-05 09:38:19.889 GMT|HandshakeContext.java:296|Ignore unsupported cipher suite: TLS_AES_128_GCM_SHA256 for TLSv1.2
javax.net.ssl|WARNING|12|task-1|2024-07-05 09:38:19.912 GMT|ServerNameExtension.java:261|Unable to indicate server name
javax.net.ssl|DEBUG|12|task-1|2024-07-05 09:38:19.912 GMT|SSLExtensions.java:260|Ignore, context unavailable extension: server_name

内容的提问来源于stack exchange，提问作者Ninjavas