4

Getting this error on using jdk-11 (Oracle 11.0.10) to make a HTTPS connection

javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at java.base/sun.security.ssl.HandshakeContext.<init>(HandshakeContext.java:170) ~[na:na]
        at java.base/sun.security.ssl.ClientHandshakeContext.<init>(ClientHandshakeContext.java:98) ~[na:na]
        at java.base/sun.security.ssl.TransportContext.kickstart(TransportContext.java:221) ~[na:na]
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:394) ~[na:na]
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:373) ~[na:na]
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436) ~[httpclient-4.5.13.jar:4.5.13]
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384) ~[httpclient-4.5.13.jar:4.5.13]
        at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142) ~[httpclient-4.5.13.jar:4.5.13]
        at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:376) ~[httpclient-4.5.13.jar:4.5.13]

I have tried to disable or edit jdk.tls.disabledAlgorithms but still the same issue.
The java.security I edited is under - C:\Program Files\Java\jdk-11.0.10\conf\security

Vignesh Prasad V
  • 419
  • 3
  • 17
  • Can you try upgrading to java 14? it might fix your issue without any config or code change. – Sari Alalem Jan 28 '21 at 14:56
  • I would like to use java 11 as it is LTS. Should I have any code change in java 11? – Vignesh Prasad V Jan 29 '21 at 06:20
  • Java 11 should support all modern TLS version(s) and ciphers. If something does not work you have to check what TLS versions and ciphers are supported by the server. You can test the server online on https://www.ssllabs.com/ssltest or for private/intranet servers via script/program https://testssl.sh – Robert Jan 29 '21 at 14:46
  • i have this issue while connecting to google via smtp and got it from update openjdk 11.0.10 to 11.0.11 – davey May 25 '21 at 07:38
  • "I have tried to disable or edit" ← does not tell us what were you trying to do. Even if you did, there's still a crucial part of info missing - WHAT is triggering this alarm. Dump that server endpoint's SSL info (e.g. what he did: https://stackoverflow.com/questions/67899129/postfix-and-openjdk-11-no-appropriate-protocol-protocol-is-disabled-or-cipher) (protocols, supported cypher suites, etc.) and post them in the question. And also share what changes you have tried (disabledAlgorithms, ./conf/security). Then we can talk – netikras Aug 07 '21 at 20:00
  • 1
    @davey: _mail_ (SMTPS) on 11.0.11 is a different issue than HTTPS on 11.0.10, and is covered in #67899129 as linked just above by netikras. – dave_thompson_085 Aug 08 '21 at 07:41

2 Answers2

1

This exception is due to TLSv1 and TLSv1.1 deprecation.

As of OpenJDK 8u292 onward, 11.0.11 onward and all versions of OpenJDK 16 read here, all TLS connections require version TLSv1.2 or TLSv1.3 to be used. You can set the TLS version to be used just by setting a Java System property.

For HTTPS connections that use HttpsURLConnection: System.setProperty("https.protocols", "TLSv1.2");

Fot SMTPS connections: System.setProperty("mail.smtp.ssl.protocols", "TLSv1.2");

Fot POP3S connections: System.setProperty("mail.pop3s.ssl.protocols", "TLSv1.2");

Use the aforementioned commands just before the source of your client.

Georgios Syngouroglou
  • 18,813
  • 9
  • 90
  • 92
  • 1
    The default-disabling of 1(.0) and 1.1 is in 11.0.11 and 16 up, not 11.0.10 as in this Q. There is no TLSv2 or v3; **SSL**v3 has been disabled since 8u31, and SSLv2 was never implemented in any Java. Also, sysprop `https.protocols` controls `HttpsURLConnection` but not apache httpclient (normally) as in this Q. – dave_thompson_085 Aug 08 '21 at 07:43
0

I had the same issue with java 11.0.11. Update your java or use previous versions. It works for me with openjdk version "11.0.8" OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.8+10).

Anastasiia
  • 1