[NIFI-8037] Support TLS 1.3 in SSLContextService on Java 8

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Resolved
• Affects Version/s: 1.13.0, 1.12.1
• Component/s: Security
• Environment: AdoptOpenJDK 8 Update 275 and Azul Zulu JDK 8 Update 275
• Assignee: David Handermann
• Reporter: David Handermann
• Created: 23/Nov/20 13:23
• Updated: 19/Jul/21 19:35
• Resolved: 24/May/21 04:48

Description

The following vendors introduced support for TLS 1.3 on Java 8:

• Oracle JDK 8 Update 261
• Azul Zulu JDK 8 Update 262
• AdoptOpenJDK 8 Update 272

The StandardSSLContextService and StandardRestrictedSSLContextService services do not support selecting TLS 1.3 when running on Java 8 due to TlsConfiguration class methods checking the Java runtime version and return TLSv1.2 for versions older than Java 11.

Improvements to resolve unit test issues with TLS protocols in NIFI-8019 could be leveraged to support runtime determination of supported TLS protocol versions. This would provide the option to select TLS 1.3 when running on supported versions of Java 8 and remove the need for checking the Java version number.

Issue Links

• fixes: NIFI-7662 Add unit tests for Java 8 update 262 TLS v1.3 handling for different vendors
• is related to: NIFI-8019 SSL Enabled Protocol test failures when TLSv1 and TLSv1.1 disabled in java.security
• relates to: NIFI-6563 Add support for TLSv1.3 when running on Java 11
• links to: GitHub Pull Request #4827