TLS 1.3

[martin naskovski <ma...@naskovski.info>]

Hello - can I configure ActiveMQ 5.6.12 with TLS 1.3? I've a requirement to
support TLS 1.3 in addition to TLS 1.2. The documentation says to add the
protocol like so:

transport.enabledProtocols=TLSv1.2,TLSv1.3
socket.enabledProtocols=TLSv1.2,TLSv1.3

but I am paranoid if this is a tested/supported configuration. Has anyone
else gotten TLS 1.3 working with ActiveMQ?

Thank you,
Martin

Re: TLS 1.3

[Robbie Gemmell <ro...@gmail.com>]

To add to the below, Java 11+ has TLS 1.3 enabled by default, e.g for
the generic "TLS" protocol name, so unless something specifically
restricts the enabledProtocols then it will be enabled.

I believe more recent Java 8 JVMs have it enabled by default on the
server side, but not the client side, requiring them to explicitly
enable it (using mechanisms such as below) for them to actually use it
in order to not affect compatibility.

(I assume the version was meant to be 5.16.2, there doesn't look to be
a 5.6.12, though it would be ancient if there were)

On Fri, 15 Oct 2021 at 01:46, Justin Bertram <jb...@apache.org> wrote:
>
> Whether or not TLS 1.3 works for you really depends on the JVM you're
> using. The "enabledProtocols" settings are passed through to the underlying
> instance of javax.net.ssl.SSLEngine provided by the JVM [1].
>
>
> Justin
>
> [1]
> https://docs.oracle.com/en/java/javase/11/docs/api/java.base/javax/net/ssl/SSLEngine.html#setEnabledProtocols(java.lang.String%5B%5D)
>
> On Thu, Oct 14, 2021 at 4:24 PM martin naskovski <ma...@naskovski.info>
> wrote:
>
> > Hello - can I configure ActiveMQ 5.6.12 with TLS 1.3? I've a requirement to
> > support TLS 1.3 in addition to TLS 1.2. The documentation says to add the
> > protocol like so:
> >
> > transport.enabledProtocols=TLSv1.2,TLSv1.3
> > socket.enabledProtocols=TLSv1.2,TLSv1.3
> >
> > but I am paranoid if this is a tested/supported configuration. Has anyone
> > else gotten TLS 1.3 working with ActiveMQ?
> >
> > Thank you,
> > Martin
> >

Re: TLS 1.3

[Justin Bertram <jb...@apache.org>]

Whether or not TLS 1.3 works for you really depends on the JVM you're
using. The "enabledProtocols" settings are passed through to the underlying
instance of javax.net.ssl.SSLEngine provided by the JVM [1].


Justin

[1]
https://docs.oracle.com/en/java/javase/11/docs/api/java.base/javax/net/ssl/SSLEngine.html#setEnabledProtocols(java.lang.String%5B%5D)

On Thu, Oct 14, 2021 at 4:24 PM martin naskovski <ma...@naskovski.info>
wrote:

> Hello - can I configure ActiveMQ 5.6.12 with TLS 1.3? I've a requirement to
> support TLS 1.3 in addition to TLS 1.2. The documentation says to add the
> protocol like so:
>
> transport.enabledProtocols=TLSv1.2,TLSv1.3
> socket.enabledProtocols=TLSv1.2,TLSv1.3
>
> but I am paranoid if this is a tested/supported configuration. Has anyone
> else gotten TLS 1.3 working with ActiveMQ?
>
> Thank you,
> Martin
>