TLS (Transport Layer Security) version 1.3 is a security protocol. It is an upgrade of TLS version 1.2, and provides improvements in speed, efficiency, security and privacy.
Questions tagged [tls1.3]
374 questions
22
votes
1 answer
Java 11 and 12 SSL sockets fail on a handshake_failure error with TLSv1.3 enabled
While developing a SSL-based (non HTTP) server in Java 12, I met unexpected difficulties for having the server and the client talk together. The connection was always interrupted with a handshake_failure error. After lots of efforts (initially I was…
Corentor
- 661
- 1
- 6
- 11
21
votes
2 answers
How to enable TLSv1.3 for OkHttp 3.12.x on Android 8/9?
I'm using OkHttp 3.12.2 on Android 9 (Pixel 2 device) and try to connect to an nginx 1.14.0 running with OpenSSL 1.1.1. The nginx is capable of TLSv1.3, I verified this with Firefox 66.0.2 on Ubuntu 18.04, Chrome 73.0 on Android 9 and ChromeOS…
Andreas
- 529
- 1
- 6
- 9
14
votes
1 answer
How to handle HttpWebRequest C# with Tls 1.3
I am unable to connect to an HTTPS server (TLS 1.3) using WebRequest because of this error message:
The request was aborted: Could not create SSL/TLS secure channel.
The previous TLS version was 1.2 and with below code I could GET the page properly…
user1760129
- 143
- 1
- 1
- 7
12
votes
1 answer
How can I get just the TLS handshake, without the record layer?
I was looking at the recent Internet drafts for the QUIC transport protocol (transport and TLS), and wondered how that could be implemented in Java (or another JVM language), assuming I don't want to reimplement TLS 1.3 at the same time.
TLS is…
Paŭlo Ebermann
- 73,284
- 20
- 146
- 210
11
votes
0 answers
Is there a way for Windows 7 to support TLS 1.3 (.NET 4.8)
As far as I have read Win7 doesn't support TLS1.3, although there is rare information on this. Is there a way for Windows 7 to support TLS1.3, and if so how to do it?
I have coded my application in .NET 4.8 which supports TLS1.3, but Windows 7 still…
Gregory
- 111
- 1
- 5
10
votes
2 answers
Apache 2.4.37 with openssl 1.1.1: cannot perform post-handshake authentication
I updated apache to last version 2.4.37 and openssl to 1.1.1 and now, when client authenticates, I get this error only with Firefox 63, but not in Chrome:
[ssl:error] AH: verify client post handshake, referer: https://******/login
[ssl:error]…
antoniofr
- 101
- 1
- 1
- 5
9
votes
2 answers
How to make OpenSSL C server only support TLS 1.3?
We are having a Linux C program making use of OpenSSL APIs, acting as a TLS server. It currently has code as:
context = SSL_CTX_new(TLS_method());
Which the OpenSSL v1.1.1 manual page says will support SSLv3, TLSv1, TLSv1.1, TLSv1.2 and TLSv1.3.…
hardbean
- 93
- 1
- 6
9
votes
1 answer
SpringBoot MVC - Warning: org.apache.tomcat.util.net.SSLUtilBase : The JSSE TLS 1.3 implementation does not support authentication
A question about Spring Boot MVC with Tomcat and TLSv1.3
I used to have a Spring Boot MVC, Tomcat based web app, with very simple business logic, over ssl HTTPS.
Per security team review, I had to bump the TLS version from TLSv1.2 to…
PatPanda
- 3,644
- 9
- 58
- 154
9
votes
2 answers
9
votes
4 answers
curl: RSA_padding_check_PKCS1_type_1:invalid padding
I am generating an X509 certificate through code (using OpenSSL APIs) for my server application. I have just added support for TLSv1.3 by adding TLSv1.3 ciphers in the supported list in my code.
There is no change in certificate generation and…
Brijesh Valera
- 1,085
- 2
- 9
- 30
8
votes
1 answer
SSL handshake failure with TLS 1.3
curl fails with openssl version 1.1.1d butt works fine with OpenSSL/1.0.1t. I am trying to debug the reason and unable tto find one.
Please find below trace from curl logs.
Failure case (curl 7.64.0 (x86_64-pc-linux-gnu) libcurl/7.64.0…
SunilS
- 2,030
- 5
- 34
- 62
8
votes
1 answer
Filter TLS 1.3 traffic in Wireshark
Is there a simple way to filter TLS 1.3 packets in Wireshark?
tls.record.version will not work because it usually contains a value of 0x0303 (TLS 1.2).
I assume that Wireshark recognizes TLS 1.3 by looking at the SupportedVersions extension in…
seladb
- 852
- 1
- 13
- 29
6
votes
0 answers
Google suggested Security ProviderInstaller downgrade TLS to 1.2?
Using OkHttp and Google Security ProviderInstaller any connection to a domain that supports both TLS1.2 and TLS1.3 are made using 1.2 version. Without ProviderInstaller all works fine using 1.3.
this is sample code, using last version of okhttp and…
Alessandro Scarozza
- 4,273
- 6
- 31
- 39
5
votes
0 answers
Deno / Postgres "invalid peer certificate contents: invalid peer certificate" error
I'm using deno db to connect to a supabase postgres server.
Here's the error from deno deploy.
TLS connection failed with message: invalid peer certificate contents: invalid peer certificate: UnsupportedCertVersion
Defaulting to non-encrypted…
ThomasReggi
- 55,053
- 85
- 237
- 424
5
votes
0 answers
nginx TLSv1.3 redundant post-handshake session ticket?
So I was playing with TLSv1.3 in nginx and during the tests with curl and openssl I saw the following pattern:
curl -v https://domain-using-tls2:
...
>
* TLSv1.2 (IN), TLS handshake, Newsession Ticket (4):
* Connection state…
123
- 51
- 2
- 4