NettyWebServer uses a deprecated constructor for JdkSslContext

Environment Details

• Helidon Version: 1.0.1
• Helidon SE
• JDK version: irrelevant
• OS: irrelevant
• Docker version (if applicable): irrelevant

---

Problem Description

We would like to use Helidon, but with a restricted TLS version (1.2). Helidon does not allow this, and also uses a deprecated constructor of JdkSslContext in NettyWebServer.java. Please change to use the non deprecated constructor, and also make it configurable which protocols to enable / use

Steps to reproduce

“Step by step instructions to reproduce the problem”

Start WebServer, do openssl s_client -connect localhost:port -tls1, this should fail if setup with “TLSv1.2”

[romain-grecourt]

This will be part of the next release, most likely next week or so.

[romain-grecourt]

Most of the suggested implementation was kept, except the attribute changed from String[] to a Set<String> and config mapping was added.

However I forgot to add a new method to ServerConfiguration.Builder (oops), this is a bug that will be fixed promptly.

Basically this means that in v1.0.3 you can’t set the SSL enabled protocols for the default socket programmatically.

You can do it with configuration like this:

server:
  port: 8080
  host: 0.0.0.0
  ssl-protocols:
    - "TLSv1.2"
  ssl:
    private-key:
      keystore-resource-path: "xxx"
      keystore-passphrase: "xxx"

You can also configure an additional socket for SSL, programmatically or by config:

ServerConfiguration serverConfig = ServerConfiguration.builder()
        .addSocket("secure", SocketConfiguration.builder()
                .port(8081)
                .enabledSSlProtocols("TLSv1.2"))
        .build(); 

server:
  port: 8080
  host: 0.0.0.0
  sockets:
    secure:
      port: 8082
      host: 0.0.0.0
      ssl-protocols:
        - "TLSv1.2"
      ssl:
        private-key:
          keystore-resource-path: "xxx"
          keystore-passphrase: "xxx"

Note the inconsistency in the configuration with “ssl-protocols” and “ssl”. We will re-work the SSL configuration sometime soon to address that and the way to configure the SSL enabled protocols will change then.