TLS version incompatibility when using latest JDKs with MySQL <8

Hi! I’ve been working on fixing an issue in Testcontainers’ test suite, and found a related issue here as well.

https://bugs.openjdk.java.net/browse/JDK-8202343 has disabled TLS1 and TLS1.1 in the latest versions of JDKs, and this seems to be particularly troublesome for connections to legacy versions of MySQL (e.g. 5.6, 5.7).

Following this (quite surprising) change to the JDK, the SslBridgeHandler code here is now capable of producing an invalid set of TLS protocols when using:

• An up to date OpenJDK, e.g. 1.11.0-11
• A MySQL server version <=8.0.4 (even though, per docs and my own testing, >=5.7.28 and >=5.6.46 are capable of using TLS1.2)

With this combination of new and old, r2dbc-mysql is choosing to use TLS1.1/TLS1, which quickly fails with:

Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)

I’d imagine that a small tweak to the isEnabledTls1_2 function would allow TLS1.2 to be used with older MySQL versions that can use it, so that the library is less inclined to try to use one of the disabled protocols. It might be good to fail-fast as well, with an informative exception when this incompatibility arises.

[mirromutth]

Hi there,

Great thanks for your report. Apologies for the late reply.

I think isEnabledTls1_2 should be changed and SslBridgeHandler need print a warn log if it matches TLS1.1 or earlier.

I’m following up on this ticket, it should be resolved soon.

[hongjunan]

i have had same issue. latest jdk(11.0.11+9) doesn’t support TLSv 1.0, 1.1. so you have to specify tls version exaclty. like below

r2dbc:mysql://testdb-mysql:3306/testdb?tlsVersion=TLSv1.2