You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@hc.apache.org by "Michael Osipov (Jira)" <ji...@apache.org> on 2023/01/16 12:32:00 UTC

[jira] [Commented] (HTTPCLIENT-2258) Why "TLS" protocol is used by default

    [ https://issues.apache.org/jira/browse/HTTPCLIENT-2258?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17677355#comment-17677355 ] 

Michael Osipov commented on HTTPCLIENT-2258:
--------------------------------------------

I would expect that it selects the best option: https://docs.oracle.com/javase/9/docs/specs/security/standard-names.html#sslcontext-algorithms?

> Why "TLS" protocol is used by default
> -------------------------------------
>
>                 Key: HTTPCLIENT-2258
>                 URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2258
>             Project: HttpComponents HttpClient
>          Issue Type: Wish
>    Affects Versions: 5.2.1
>            Reporter: Aleksandr Beliakov
>            Priority: Minor
>
> Hello,
>  
> [SSLContextBuilder.java|https://github.com/apache/httpcomponents-core/blob/rel/v5.2.1/httpcore5/src/main/java/org/apache/hc/core5/ssl/SSLContextBuilder.java] defines "TLS" version of SSL protocol to be used as a default value in initialization of the SSLContext.
> Why the old version is used and it is not updated to the recommended now "TLSv1.3" version of SSL protocol? The version has been also added as a default one to be used in JDK 8. See [Oracle JRE and JDK Cryptographic Roadmap|https://www.java.com/en/jre-jdk-cryptoroadmap.html]
>  
> Thank you.
>  
> Best regards,
> Aleksandr.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org