Uploaded image for project: 'Apache NiFi'
  1. Apache NiFi
  2. NIFI-8630

PutEmail fails to negotiate TLS1.2 with latest JDK.

    XMLWordPrintableJSON

Details

    Description

      On April 20, 2021 with the latest JDK the support for TLS 1.0 and 1.1 was removed/disabled. Using the PutEmail processor with the latest OpenJdk and TLS set to true is failing with:

      Failed to send email for StandardFlowFileRecord[uuid=7e8d3482-59ac-4993-a9ea-fa9089ced554,claim=,offset=0,name=7e8d3482-59ac-4993-a9ea-fa9089ced554,size=0]: Could not convert socket to TLS; routing to failure: javax.mail.MessagingException: Could not convert socket to TLS;
        nested exception is:
              javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
      javax.mail.MessagingException: Could not convert socket to TLS
              at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:1907)
              at com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:666)
              at javax.mail.Service.connect(Service.java:317)
              at javax.mail.Service.connect(Service.java:176)
              at javax.mail.Service.connect(Service.java:125)
              at javax.mail.Transport.send0(Transport.java:194)
              at javax.mail.Transport.send(Transport.java:124)
              at org.apache.nifi.processors.standard.PutEmail.send(PutEmail.java:541)
              at org.apache.nifi.processors.standard.PutEmail.onTrigger(PutEmail.java:395)
              at org.apache.nifi.processor.AbstractProcessor.onTrigger(AbstractProcessor.java:27)
              at org.apache.nifi.controller.StandardProcessorNode.onTrigger(StandardProcessorNode.java:1173)
              at org.apache.nifi.controller.tasks.ConnectableTask.invoke(ConnectableTask.java:214)
              at org.apache.nifi.controller.scheduling.TimerDrivenSchedulingAgent$1.run(TimerDrivenSchedulingAgent.java:117)
              at org.apache.nifi.engine.FlowEngine$2.run(FlowEngine.java:110)
      

      From my research the javax.mail version is quite old and it is known that 1.4.x fails to renegotiate with better tls algorithm. But I think it would be better to add new Property Descriptor to the PutEmail processor that will default the ssl protocol to TLS1.2.

      • Update the javax.mail dependency.
      • Add PropertyDescriptor for setting the ssl algorithm that will default to TLS 1.2

      Attachments

        Issue Links

          Activity

            People

              exceptionfactory David Handermann
              branko.peshevski Branko Peshevski
              Votes:
              2 Vote for this issue
              Watchers:
              6 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 50m
                  50m