Skip to content

Commit 315c971

Browse files
jaymodejaymode
authored
Update TLS ciphers and protocols for JDK 11 (#41385)
This commit updates the default ciphers and TLS protocols that are used after the minimum supported JDK is JDK 11. The conditionals around TLSv1.3 and 256-bit cipher support have been removed. JDK 11 no longer requires an unlimited JCE policy file for 256 bit cipher support and TLSv1.3 is supported in JDK 11+. New cipher support has been introduced in the newer JDK versions as well. The ciphers are ordered with PFS ciphers being most preferred, then AEAD ciphers, and finally those with mainstream hardware support.
1 parent 46d25e6 commit 315c971

25 files changed

Lines changed: 135 additions & 174 deletions

File tree

‎docs/reference/settings/security-settings.asciidoc‎

Lines changed: 16 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -513,8 +513,7 @@ and `full`. Defaults to `full`.
513513
See <<ssl-tls-settings,`ssl.verification_mode`>> for an explanation of these values.
514514

515515
`ssl.supported_protocols`::
516-
Supported protocols for TLS/SSL (with versions). Defaults to `TLSv1.3,TLSv1.2,TLSv1.1` if
517-
the JVM supports TLSv1.3, otherwise `TLSv1.2,TLSv1.1`.
516+
Supported protocols for TLS/SSL (with versions). Defaults to `TLSv1.3,TLSv1.2,TLSv1.1`.
518517

519518
`ssl.cipher_suites`:: Specifies the cipher suites that should be supported when
520519
communicating with the LDAP server.
@@ -765,8 +764,7 @@ and `full`. Defaults to `full`.
765764
See <<ssl-tls-settings,`ssl.verification_mode`>> for an explanation of these values.
766765

767766
`ssl.supported_protocols`::
768-
Supported protocols for TLS/SSL (with versions). Defaults to `TLSv1.3,TLSv1.2,TLSv1.1` if
769-
the JVM supports TLSv1.3, otherwise `TLSv1.2,TLSv1.1`.
767+
Supported protocols for TLS/SSL (with versions). Defaults to `TLSv1.3,TLSv1.2,TLSv1.1`.
770768

771769
`ssl.cipher_suites`:: Specifies the cipher suites that should be supported when
772770
communicating with the Active Directory server.
@@ -1173,8 +1171,7 @@ Defaults to `full`.
11731171
See <<ssl-tls-settings,`ssl.verification_mode`>> for a more detailed explanation of these values.
11741172

11751173
`ssl.supported_protocols`::
1176-
Specifies the supported protocols for TLS/SSL. Defaults to `TLSv1.3,TLSv1.2,TLSv1.1` if
1177-
the JVM supports TLSv1.3, otherwise `TLSv1.2,TLSv1.1`.
1174+
Specifies the supported protocols for TLS/SSL. Defaults to `TLSv1.3,TLSv1.2,TLSv1.1`.
11781175

11791176
`ssl.cipher_suites`::
11801177
Specifies the
@@ -1489,8 +1486,7 @@ settings. For more information, see
14891486

14901487
`ssl.supported_protocols`::
14911488
Supported protocols with versions. Valid protocols: `SSLv2Hello`,
1492-
`SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. Defaults to `TLSv1.3,TLSv1.2,TLSv1.1` if
1493-
the JVM supports TLSv1.3, otherwise `TLSv1.2,TLSv1.1`.
1489+
`SSLv3`, `TLSv1`, `TLSv1.1`, `TLSv1.2`, `TLSv1.3`. Defaults to `TLSv1.3,TLSv1.2,TLSv1.1`.
14941490
+
14951491
--
14961492
NOTE: If `xpack.security.fips_mode.enabled` is `true`, you cannot use `SSLv2Hello`
@@ -1521,13 +1517,18 @@ Controls the verification of certificates. Valid values are:
15211517
The default value is `full`.
15221518

15231519
`ssl.cipher_suites`::
1524-
Supported cipher suites can be found in Oracle's http://docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html[
1525-
Java Cryptography Architecture documentation]. Defaults to `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`,
1526-
`TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`,
1527-
`TLS_RSA_WITH_AES_128_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA`. If the _Java Cryptography Extension (JCE) Unlimited Strength
1528-
Jurisdiction Policy Files_ has been installed, the default value also includes `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`,
1529-
`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`,
1530-
`TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_256_CBC_SHA`.
1520+
Supported cipher suites can be found in Oracle's
1521+
https://docs.oracle.com/en/java/javase/11/security/oracle-providers.html#GUID-7093246A-31A3-4304-AC5F-5FB6400405E2[Java Cryptography Architecture documentation].
1522+
Defaults to `TLS_AES_256_GCM_SHA384`, `TLS_AES_128_GCM_SHA256`,
1523+
`TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256`,
1524+
`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256`,
1525+
`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256`,
1526+
`TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`,
1527+
`TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA`,
1528+
`TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA`, `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA`,
1529+
`TLS_RSA_WITH_AES_256_GCM_SHA384`, `TLS_RSA_WITH_AES_128_GCM_SHA256`,
1530+
`TLS_RSA_WITH_AES_256_CBC_SHA256`, `TLS_RSA_WITH_AES_128_CBC_SHA256`,
1531+
`TLS_RSA_WITH_AES_256_CBC_SHA`, `TLS_RSA_WITH_AES_128_CBC_SHA`.
15311532

15321533
[float]
15331534
[[tls-ssl-key-settings]]

‎libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfiguration.java‎

Lines changed: 1 addition & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
import javax.net.ssl.X509ExtendedTrustManager;
2525
import java.nio.file.Path;
2626
import java.security.GeneralSecurityException;
27-
import java.security.NoSuchAlgorithmException;
2827
import java.util.Collection;
2928
import java.util.Collections;
3029
import java.util.HashSet;
@@ -52,12 +51,7 @@ public class SslConfiguration {
5251
static final Map<String, String> ORDERED_PROTOCOL_ALGORITHM_MAP;
5352
static {
5453
LinkedHashMap<String, String> protocolAlgorithmMap = new LinkedHashMap<>();
55-
try {
56-
SSLContext.getInstance("TLSv1.3");
57-
protocolAlgorithmMap.put("TLSv1.3", "TLSv1.3");
58-
} catch (NoSuchAlgorithmException e) {
59-
// ignore since we support JVMs that do not support TLSv1.3
60-
}
54+
protocolAlgorithmMap.put("TLSv1.3", "TLSv1.3");
6155
protocolAlgorithmMap.put("TLSv1.2", "TLSv1.2");
6256
protocolAlgorithmMap.put("TLSv1.1", "TLSv1.1");
6357
protocolAlgorithmMap.put("TLSv1", "TLSv1");

‎libs/ssl-config/src/main/java/org/elasticsearch/common/ssl/SslConfigurationLoader.java‎

Lines changed: 16 additions & 49 deletions
Original file line numberDiff line numberDiff line change
@@ -19,21 +19,15 @@
1919

2020
package org.elasticsearch.common.ssl;
2121

22-
import javax.crypto.Cipher;
2322
import javax.net.ssl.KeyManagerFactory;
2423
import javax.net.ssl.TrustManagerFactory;
2524
import java.nio.file.Path;
26-
import java.security.NoSuchAlgorithmException;
27-
import java.util.ArrayList;
28-
import java.util.Arrays;
29-
import java.util.Collections;
3025
import java.util.List;
3126
import java.util.Objects;
3227
import java.util.function.Function;
3328
import java.util.stream.Collectors;
3429

3530
import static org.elasticsearch.common.ssl.KeyStoreUtil.inferKeyStoreType;
36-
import static org.elasticsearch.common.ssl.SslConfiguration.ORDERED_PROTOCOL_ALGORITHM_MAP;
3731
import static org.elasticsearch.common.ssl.SslConfigurationKeys.CERTIFICATE;
3832
import static org.elasticsearch.common.ssl.SslConfigurationKeys.CERTIFICATE_AUTHORITIES;
3933
import static org.elasticsearch.common.ssl.SslConfigurationKeys.CIPHERS;
@@ -70,10 +64,22 @@
7064
*/
7165
public abstract class SslConfigurationLoader {
7266

73-
static final List<String> DEFAULT_PROTOCOLS = Collections.unmodifiableList(
74-
ORDERED_PROTOCOL_ALGORITHM_MAP.containsKey("TLSv1.3") ?
75-
Arrays.asList("TLSv1.3", "TLSv1.2", "TLSv1.1") : Arrays.asList("TLSv1.2", "TLSv1.1"));
76-
static final List<String> DEFAULT_CIPHERS = loadDefaultCiphers();
67+
static final List<String> DEFAULT_PROTOCOLS = List.of("TLSv1.3", "TLSv1.2", "TLSv1.1");
68+
69+
/**
70+
* This list has been created with ordering
71+
*/
72+
static final List<String> DEFAULT_CIPHERS = List.of(
73+
"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
74+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
75+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
76+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
77+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
78+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
79+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
80+
"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", // AEAD, hardware support
81+
"TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", // hardware support
82+
"TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"); // hardware support
7783
private static final char[] EMPTY_PASSWORD = new char[0];
7884

7985
private final String settingPrefix;
@@ -141,9 +147,6 @@ public void setDefaultClientAuth(SslClientAuthenticationMode defaultClientAuth)
141147

142148
/**
143149
* Change the default supported ciphers.
144-
* The initial cipher list depends on the availability of {@link #has256BitAES() 256 bit AES}.
145-
*
146-
* @see #loadDefaultCiphers()
147150
*/
148151
public void setDefaultCiphers(List<String> defaultCiphers) {
149152
this.defaultCiphers = defaultCiphers;
@@ -336,40 +339,4 @@ private <V> List<V> resolveListSetting(String key, Function<String, V> parser, L
336339
throw new SslConfigException("cannot retrieve setting [" + settingPrefix + key + "]", e);
337340
}
338341
}
339-
340-
private static List<String> loadDefaultCiphers() {
341-
final List<String> ciphers128 = Arrays.asList(
342-
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256",
343-
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
344-
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA",
345-
"TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA",
346-
"TLS_RSA_WITH_AES_128_CBC_SHA256",
347-
"TLS_RSA_WITH_AES_128_CBC_SHA"
348-
);
349-
final List<String> ciphers256 = Arrays.asList(
350-
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
351-
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384",
352-
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
353-
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA",
354-
"TLS_RSA_WITH_AES_256_CBC_SHA256",
355-
"TLS_RSA_WITH_AES_256_CBC_SHA"
356-
);
357-
if (has256BitAES()) {
358-
List<String> ciphers = new ArrayList<>(ciphers256.size() + ciphers128.size());
359-
ciphers.addAll(ciphers256);
360-
ciphers.addAll(ciphers128);
361-
return ciphers;
362-
} else {
363-
return ciphers128;
364-
}
365-
}
366-
367-
private static boolean has256BitAES() {
368-
try {
369-
return Cipher.getMaxAllowedKeyLength("AES") > 128;
370-
} catch (NoSuchAlgorithmException e) {
371-
// No AES? Things are going to be very weird, but technically that means we don't have 256 bit AES, so ...
372-
return false;
373-
}
374-
}
375342
}

‎modules/reindex/src/test/java/org/elasticsearch/index/reindex/ReindexRestClientSslTests.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -120,6 +120,7 @@ public void testClientFailsWithUntrustedCertificate() throws IOException {
120120
final List<Thread> threads = new ArrayList<>();
121121
final Settings settings = Settings.builder()
122122
.put("path.home", createTempDir())
123+
.put("reindex.ssl.supported_protocols", "TLSv1.2")
123124
.build();
124125
final Environment environment = TestEnvironment.newEnvironment(settings);
125126
final ReindexSslConfig ssl = new ReindexSslConfig(settings, environment, mock(ResourceWatcherService.class));
@@ -134,6 +135,7 @@ public void testClientSucceedsWithCertificateAuthorities() throws IOException {
134135
final Settings settings = Settings.builder()
135136
.put("path.home", createTempDir())
136137
.putList("reindex.ssl.certificate_authorities", ca.toString())
138+
.put("reindex.ssl.supported_protocols", "TLSv1.2")
137139
.build();
138140
final Environment environment = TestEnvironment.newEnvironment(settings);
139141
final ReindexSslConfig ssl = new ReindexSslConfig(settings, environment, mock(ResourceWatcherService.class));
@@ -149,6 +151,7 @@ public void testClientSucceedsWithVerificationDisabled() throws IOException {
149151
final Settings settings = Settings.builder()
150152
.put("path.home", createTempDir())
151153
.put("reindex.ssl.verification_mode", "NONE")
154+
.put("reindex.ssl.supported_protocols", "TLSv1.2")
152155
.build();
153156
final Environment environment = TestEnvironment.newEnvironment(settings);
154157
final ReindexSslConfig ssl = new ReindexSslConfig(settings, environment, mock(ResourceWatcherService.class));
@@ -169,6 +172,7 @@ public void testClientPassesClientCertificate() throws IOException {
169172
.put("reindex.ssl.certificate", cert)
170173
.put("reindex.ssl.key", key)
171174
.put("reindex.ssl.key_passphrase", "client-password")
175+
.put("reindex.ssl.supported_protocols", "TLSv1.2")
172176
.build();
173177
AtomicReference<Certificate[]> clientCertificates = new AtomicReference<>();
174178
handler = https -> {

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/XPackSettings.java‎

Lines changed: 12 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@
66

77
package org.elasticsearch.xpack.core;
88

9-
import org.apache.logging.log4j.LogManager;
109
import org.elasticsearch.common.settings.Setting;
1110
import org.elasticsearch.common.settings.Setting.Property;
1211
import org.elasticsearch.xpack.core.security.SecurityField;
@@ -15,13 +14,10 @@
1514
import org.elasticsearch.xpack.core.ssl.SSLConfigurationSettings;
1615
import org.elasticsearch.xpack.core.ssl.VerificationMode;
1716

18-
import javax.crypto.Cipher;
1917
import javax.crypto.SecretKeyFactory;
20-
import javax.net.ssl.SSLContext;
2118

2219
import java.security.NoSuchAlgorithmException;
2320
import java.util.ArrayList;
24-
import java.util.Arrays;
2521
import java.util.Collections;
2622
import java.util.List;
2723
import java.util.Locale;
@@ -38,7 +34,6 @@ private XPackSettings() {
3834
throw new IllegalStateException("Utility class should not be instantiated");
3935
}
4036

41-
4237
/**
4338
* Setting for controlling whether or not CCR is enabled.
4439
*/
@@ -122,28 +117,17 @@ private XPackSettings() {
122117
* SSL settings. These are the settings that are specifically registered for SSL. Many are private as we do not explicitly use them
123118
* but instead parse based on a prefix (eg *.ssl.*)
124119
*/
125-
public static final List<String> DEFAULT_CIPHERS;
126-
127-
static {
128-
List<String> ciphers = Arrays.asList("TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256",
129-
"TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA256",
130-
"TLS_RSA_WITH_AES_128_CBC_SHA");
131-
try {
132-
final boolean use256Bit = Cipher.getMaxAllowedKeyLength("AES") > 128;
133-
if (use256Bit) {
134-
List<String> strongerCiphers = new ArrayList<>(ciphers.size() * 2);
135-
strongerCiphers.addAll(Arrays.asList("TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384",
136-
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA",
137-
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_256_CBC_SHA"));
138-
strongerCiphers.addAll(ciphers);
139-
ciphers = strongerCiphers;
140-
}
141-
} catch (NoSuchAlgorithmException e) {
142-
// ignore it here - there will be issues elsewhere and its not nice to throw in a static initializer
143-
}
144-
145-
DEFAULT_CIPHERS = ciphers;
146-
}
120+
public static final List<String> DEFAULT_CIPHERS = List.of(
121+
"TLS_AES_256_GCM_SHA384", "TLS_AES_128_GCM_SHA256", // TLSv1.3 cipher has PFS, AEAD, hardware support
122+
"TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
123+
"TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", // PFS, AEAD, hardware support
124+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
125+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", // PFS, hardware support
126+
"TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
127+
"TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA", // PFS, hardware support
128+
"TLS_RSA_WITH_AES_256_GCM_SHA384", "TLS_RSA_WITH_AES_128_GCM_SHA256", // AEAD, hardware support
129+
"TLS_RSA_WITH_AES_256_CBC_SHA256", "TLS_RSA_WITH_AES_128_CBC_SHA256", // hardware support
130+
"TLS_RSA_WITH_AES_256_CBC_SHA", "TLS_RSA_WITH_AES_128_CBC_SHA"); // hardware support
147131

148132
/*
149133
* Do not allow insecure hashing algorithms to be used for password hashing
@@ -164,19 +148,7 @@ private XPackSettings() {
164148
}
165149
}, Setting.Property.NodeScope);
166150

167-
public static final List<String> DEFAULT_SUPPORTED_PROTOCOLS;
168-
169-
static {
170-
boolean supportsTLSv13 = false;
171-
try {
172-
SSLContext.getInstance("TLSv1.3");
173-
supportsTLSv13 = true;
174-
} catch (NoSuchAlgorithmException e) {
175-
LogManager.getLogger(XPackSettings.class).debug("TLSv1.3 is not supported", e);
176-
}
177-
DEFAULT_SUPPORTED_PROTOCOLS = supportsTLSv13 ?
178-
Arrays.asList("TLSv1.3", "TLSv1.2", "TLSv1.1") : Arrays.asList("TLSv1.2", "TLSv1.1");
179-
}
151+
public static final List<String> DEFAULT_SUPPORTED_PROTOCOLS = List.of("TLSv1.3", "TLSv1.2", "TLSv1.1");
180152

181153
public static final SSLClientAuth CLIENT_AUTH_DEFAULT = SSLClientAuth.REQUIRED;
182154
public static final SSLClientAuth HTTP_CLIENT_AUTH_DEFAULT = SSLClientAuth.NONE;

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ssl/SSLService.java‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -57,8 +57,6 @@
5757
import java.util.function.Supplier;
5858
import java.util.stream.Collectors;
5959

60-
import static org.elasticsearch.xpack.core.XPackSettings.DEFAULT_SUPPORTED_PROTOCOLS;
61-
6260
/**
6361
* Provides access to {@link SSLEngine} and {@link SSLSocketFactory} objects based on a provided configuration. All
6462
* configurations loaded by this service must be configured on construction.
@@ -75,9 +73,7 @@ public class SSLService {
7573
private static final Map<String, String> ORDERED_PROTOCOL_ALGORITHM_MAP;
7674
static {
7775
LinkedHashMap<String, String> protocolAlgorithmMap = new LinkedHashMap<>();
78-
if (DEFAULT_SUPPORTED_PROTOCOLS.contains("TLSv1.3")) {
79-
protocolAlgorithmMap.put("TLSv1.3", "TLSv1.3");
80-
}
76+
protocolAlgorithmMap.put("TLSv1.3", "TLSv1.3");
8177
protocolAlgorithmMap.put("TLSv1.2", "TLSv1.2");
8278
protocolAlgorithmMap.put("TLSv1.1", "TLSv1.1");
8379
protocolAlgorithmMap.put("TLSv1", "TLSv1");

‎x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ssl/TrustConfig.java‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -119,9 +119,8 @@ X509ExtendedTrustManager createTrustManager(@Nullable Environment environment) {
119119

120120
try {
121121
return CertParsingUtils.trustManager(trustConfigs.stream()
122-
.flatMap((tc) -> Arrays.stream(tc.createTrustManager(environment).getAcceptedIssuers()))
123-
.collect(Collectors.toList())
124-
.toArray(new X509Certificate[0]));
122+
.flatMap((tc) -> Arrays.stream(tc.createTrustManager(environment).getAcceptedIssuers()))
123+
.toArray(X509Certificate[]::new));
125124
} catch (Exception e) {
126125
throw new ElasticsearchException("failed to create trust manager", e);
127126
}

0 commit comments

Comments
 (0)