TLSv1 and TLSv1.1 is not supported by Netty

Expected behaviour

With an endpoint that only supports TLSv1 and TLSv1.1, the handshake should be successful

Actual behaviour

With an endpoint that only supports TLSv1 and TLSv1.1, the handshake fails with SSLHandshakeException

Steps to reproduce

Write any dummy app that does handshake using Netty.

Test Code

https://github.com/Sandeep-CodeAcc/NettyClient.git Please clone above git, build and run the App.java

Netty version

4.1.63.Final

JVM version (e.g. java -version)

Java 1.8.0_291 from Oracle. You might need to change java.security file to enable the TLSv1 and TLSv1.1 Handshakes, by default these are disabled.

OS version (e.g. uname -a)

Darwin Kernel Version 20.6.0

[johnou]

Wasn’t it disabled? https://github.com/netty/netty/pull/11237

[chrisvest]

@Sandeep-CodeAcc I simplified your test a bit so it looks like this:

            b.handler(new ChannelInitializer<SocketChannel>() {
                @Override
                public void initChannel(SocketChannel ch)
                  throws Exception {
                    ch.pipeline().addLast(ssl().newHandler(ByteBufAllocator.DEFAULT));
                    ch.pipeline().addLast(new HttpClientCodec());
                    handler = new ClientHandler();
                    ch.pipeline().addLast(handler);
                }
            });

When the correct java.security file is updated to allow TLSv1.1, then I do see a TLSv1.1 ClientHello being sent towards the server. You can see this in Wireshark or with -Djavax.net.debug=all.

The server then responds with a handshake failure alert. You’ll need to investigate the server to see why it does that.