I am using Spring Rest template for making GET requests calls to an external API. This API does not support TLS 1.3 yet. The connection to the service works fine during normal work load.
During load testing, I observed that some of the calls were failing with the below exception:
Remote host terminated the handshake; nested exception is javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:748)
at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:674)
at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:583)
On enabling javax.debug level logs, found that for the calls that failed, TLS1.3 protocol was used for handshake.
javax.net.ssl|DEBUG|9D|http-nio-8080-exec-28|2021-02-09 16:34:59.588 UTC|SSLSocketOutputRecord.java:71|WRITE: **TLS12** alert(close_notify), length = 10
javax.net.ssl|DEBUG|06 87|http-nio-8080-exec-176|2021-02-09 16:34:08.621 UTC|SSLSocketOutputRecord.java:71|WRITE: **TLS13** alert(handshake_failure), length = 2
My application is implemented in Java 11 [openjdk 11.0.3]. Java 11 also supports TLS 1.3. In order to resolve the issue, I will have to enforce it to use TLS1.2.
I want to understand, how is the TLS protocol version to be used determined by Java? In this case, both TLS1.2 and TLS1.3 were used alternatively.