Problems enabling TLS 1.3 in Spring Boot

user_5259789 0
Viewed 1486

I have tried to enable TLS 1.3 in my Spring Boot application.

I have a HttpsConfiguration class:

@Bean
public WebServerFactoryCustomizer<TomcatServletWebServerFactory> servletContainerCustomizer() {
    return new WebServerFactoryCustomizer<TomcatServletWebServerFactory>() {
        @Override
        public void customize(TomcatServletWebServerFactory factory) {
            factory.addConnectorCustomizers(new TomcatConnectorCustomizer() {
                @Override
                public void customize(Connector connector) {
                    AbstractHttp11Protocol<?> httpHandler = ((AbstractHttp11Protocol<?>) connector.getProtocolHandler());
                    httpHandler.setUseServerCipherSuitesOrder(true);
                    httpHandler.setSSLProtocol("TLSv1.3,TLSv1.2");
                    httpHandler.setSSLHonorCipherOrder(true);
                    httpHandler.setCiphers("TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, "
                                         + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, "
                                         + "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, "
                                         + "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, "
                                         + "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, "
                                         + "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256");
                }
            });
        }
    };
}

}

And my application.properties SSL config is:

# SSL Settings
server.ssl.key-store=/etc/letsencrypt/live/arbejdsdag.dk/keystore.p12
server.ssl.key-store-password=<redacted>
server.ssl.keyStoreType=PKCS12
server.ssl.keyAlias=tomcat

I have also tried adding the relevant server.ssl.* lines to my application.properties

server.ssl.ciphers=TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
server.ssl.protocol=TLS
server.ssl.enabled-protocols=TLSv1.2,TLSv1.3

But this does not work either.

I am running openjdk version "11.0.11" 2021-04-20 on Ubuntu 18.04 and Spring Boot Starter Parent 2.5.3.

SSL Labs does not seem to pick up on this config SSL Labs scan

I'm not sure what else I need to do to get this working. Any ideas?

tls1.3 spring-boot spring java
1 Answers

I solved it by setting the ciphers that TLS 1.3 supports.

@Bean
public WebServerFactoryCustomizer<TomcatServletWebServerFactory> servletContainerCustomizer() {
    return new WebServerFactoryCustomizer<TomcatServletWebServerFactory>() {
        @Override
        public void customize(TomcatServletWebServerFactory factory) {
            factory.addConnectorCustomizers(new TomcatConnectorCustomizer() {
                @Override
                public void customize(Connector connector) {
                    AbstractHttp11Protocol<?> httpHandler = ((AbstractHttp11Protocol<?>) connector.getProtocolHandler());
                    httpHandler.setUseServerCipherSuitesOrder(true);
                    httpHandler.setSSLHonorCipherOrder(true);
                    httpHandler.setCiphers(
                              "TLS_AES_256_GCM_SHA384, "
                            + "TLS_CHACHA20_POLY1305_SHA256, "
                            + "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, "
                            + "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, "
                            + "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, "
                      );
                }
            });
        }
    };
}

}

user_52597890
Related