跟进TLS v1.2问题：Tomcat新版本是否支持TLS v1.3？

Great question! Let's break down the support for TLS 1.3 in Tomcat clearly, since you've already dug into the official docs and know Java 11 has this feature.

Key Facts: #

• Tomcat 9.0.30 and later officially support TLS 1.3 — Tomcat relies on Java's Secure Socket Extension (JSSE) for SSL/TLS functionality, so it inherits protocol support directly from the underlying Java runtime.
• As you noted, Java 11 includes native TLS 1.3 support via JEP 332 (aligned with the RFC 8446 standard). For context, even Java 8u261+ added TLS 1.3 support, but Java 11 was the first LTS release to ship with it enabled by default for compatible connections.

How to Enable TLS 1.3 in Tomcat: #

To activate TLS 1.3 (alongside TLS 1.2 for backward compatibility), update your server.xml SSL Connector configuration. Here are two valid approaches:

Modern Tomcat 9.0.23+ syntax:

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true">
    <SSLHostConfig>
        <Certificate certificateKeystoreFile="conf/localhost-rsa.jks"
                     type="RSA" />
        <!-- Explicitly enable TLS 1.2 and 1.3 -->
        <Protocols>
            <Protocol name="TLSv1.2" />
            <Protocol name="TLSv1.3" />
        </Protocols>
    </SSLHostConfig>
</Connector>

Older pre-9.0.23 syntax:

<Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true"
           enabledProtocols="TLSv1.2,TLSv1.3"
           keystoreFile="conf/localhost-rsa.jks" keystorePass="changeit" />

Why the Tomcat Docs Don't Explicitly Mention It: #

Tomcat's SSL documentation focuses on server-specific configuration rather than repeating details about JSSE-provided features. Since TLS 1.3 support is driven by the Java runtime, the docs don't call it out separately—they assume you'll reference Java's release notes for protocol-level capabilities.

Verify TLS 1.3 is Active: #

You can confirm your setup works using the openssl command line tool:

openssl s_client -connect your-server-domain:443 -tls1_3

If successful, the output will show Protocol : TLSv1.3 in the connection details section.

内容的提问来源于stack exchange，提问作者Guillaume Husta