[IGNITE-11298] TcpCommunicationSpi does not support TLSv1.3

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 2.7
• Fix Version/s: 2.8
• Component/s: general
• Labels: Java11
• Assignee: Vitaliy Biryukov
• Reporter: Ilya Kasnacheev
• Created: 12/Feb/19 14:39
• Updated: 20/Aug/21 10:45
• Resolved: 30/May/19 12:52

Description

When started on Java 11 we cannot form a secure cluster - Discovery will happily use the default TLSv1.3 but Communication will fail with its custom SSLEngine-using code.

Need to fix that.

Until that, nodes may be salvaged by setProtocol("TLSv1.2") on SslContextFactory, or by system property -Djdk.tls.client.protocols="TLSv1.2"

Issue Links

• causes: IGNITE-14678 Remove a note about TLS 1.3 being unsupported from Java quick start
• is related to: IGNITE-11860 Temporarily peg SSL version to TLSv1.2 to fix Java 11/12
• relates to: IGNITE-11299 During SSL Handshake GridNioServer.processWrite is invoked constantly
• relates to: IGNITE-11189 Support Java 11 for Apache Ignite
• links to: GitHub Pull Request #6442
• links to: JDK-8219658
• links to: SO question about TLSv1.3 changes
• links to: TC java8 TLSv1.2
• links to: TC java11 TLSv1.2
• links to: TC java11 TLSv1.3