Greetings Chintan, and thanks for your question! I've filed CASSCPP-16 (https://issues.apache.org/jira/browse/CASSCPP-16) to at least take another look at the current state of TLS 1.3 support and see if there's anything we can do. I put together a quick test branch earlier this afternoon and did some testing against Apache Cassandra 5.0.4. My client certainly wasn't connecting correctly (it appeared to fail negotiation of the TLS connection and then time out) but it's entirely possible that's due to an invalid assumption or misconfiguration on my part. I'll continue looking into it as time allows.
As far as timing goes: we are currently trying to get 2.17.2 out the door. This release would be our first since the code was donated to the ASF but unfortunately it's already been quite delayed. We've stripped out quite a few things we were planning on putting into 2.17.2 in order to get it out the door more quickly and it's _still_ taking longer than expected. I say all of that to indicate that a fix for CASSCPP-16 very likely won't be in 2.17.2; it's just really hard to justify anything that might hold the release up at all. That said, it's probably not unreasonable to expect such a change to be included in the follow-on release which we're tentatively calling 2.18.0. Finally, I'll mention that we're discussing this and other issues related to the various Apache Cassandra drivers in the #cassandra-drivers channel on ASF Slack.(https://the-asf.slack.com/). I would expect most of the conversation around this issue (and other issues related to the CPP driver) to take place there... and I'd be happy to send an invitation your way if you'd like to join us! Thanks again! - Bret - On Tue, Aug 25, 2026 at 3:25 AM Chintan Pansuriya via dev < [email protected]> wrote: > Hi Team, > I'm evaluating TLS 1.3 support in "cassandra-cpp-driver" and noticed that > the current implementation appears to cap the maximum TLS version at TLS > 1.2 ("SSL_CTX_set_max_proto_version(..., TLS1_2_VERSION)"). > From the commit history and JIRA references, it looks like TLS 1.3 support > was previously addressed under *CPP-786*, but later restricted in > *CPP-922* due to handshake issues. I couldn't find any follow-up changes > in the 2.16.x or 2.17.x releases that revisit this limitation. > Could you please provide some guidance on the following? > > 1. Is there any active work, planned release, or proposal to re-enable > TLS 1.3 support? > 2. Is there a tentative target version or timeframe for this work, if > planned? > 3. Is the handshake issue that led to the TLS 1.2 restriction still > known to affect current OpenSSL versions (3.x), or was it specific to older > OpenSSL releases? > 4. For users who require TLS 1.3 today, is there a recommended > workaround or supported approach? > > *Environment* > > - Cassandra C++ Driver: 2.17.1 > - OpenSSL: 3.5.6 > > If this inquiry would be better addressed elsewhere, please let me know > the appropriate mailing list, forum, or issue-tracking process, or feel > free to forward it to the relevant maintainers. > Thanks for your time and for maintaining the driver. Any insight into the > current status or roadmap for TLS 1.3 support would be greatly appreciated. > Thanks, > Chintan Pansuriya > The information contained in this communication from the sender is > confidential. It is intended solely for use by the recipient and others > authorized to receive it. If you are not the recipient, you are hereby > notified that any disclosure, copying, distribution or taking action in > relation of the contents of this information is strictly prohibited and may > be unlawful. The information contained in this communication from the > sender is confidential. It is intended solely for use by the recipient and > others authorized to receive it. If you are not the recipient, you are > hereby notified that any disclosure, copying, distribution or taking action > in relation of the contents of this information is strictly prohibited and > may be unlawful. >
