pjfanning opened a new pull request, #1870: URL: https://github.com/apache/pekko-connectors/pull/1870
**Motivation:** The `min-tls-version` setting added in #1808 has no effect. Both forward proxy HTTPS contexts configure the enabled protocols via: ```scala sslContext.getDefaultSSLParameters.setProtocols(protocols) ``` `SSLContext.getDefaultSSLParameters()` returns a fresh defensive copy on every call, so mutating it is discarded. Connections are negotiated with the JDK defaults regardless of the configured value, meaning `min-tls-version = "TLSv1.3"` is silently ignored and TLSv1.2 remains enabled. Demonstrated on JDK 17: ``` before: [TLSv1.3, TLSv1.2] after : [TLSv1.3, TLSv1.2] <- setProtocols(["TLSv1.3"]) had no effect ``` **Modification:** Build the `HttpsConnectionContext` from a client `SSLEngine` factory instead of from the `SSLContext`, and set the protocols on each engine's own `SSLParameters`. `ConnectionContext.httpsClient(SSLContext)` sets the `"https"` endpoint identification algorithm internally; taking the engine-factory overload bypasses that, so it is set explicitly to keep hostname verification enabled. The `minTlsVersion` lookup is moved ahead of the certificate load, so an invalid value fails before any file IO. **Result:** `min-tls-version` is honoured. With the default `TLSv1.2` the enabled set is `TLSv1.2, TLSv1.3`; with `TLSv1.3` only `TLSv1.3` is enabled. Hostname verification is unchanged. **Tests:** Added `ForwardProxyHttpsContextSpec` to `google-common` and `huawei-push-kit`, asserting the engine's enabled protocols, client mode and endpoint identification algorithm (12 tests, all passing). Verified the protocol assertion fails against the previous `getDefaultSSLParameters` implementation and passes with this change, so the test genuinely covers the regression. Ran `google-common/mimaReportBinaryIssues` and `huawei-push-kit/mimaReportBinaryIssues` (both clean) and `scalafmtCheckAll`. **References:** Follow-up to #1808. The JDK javadoc for `SSLContext.getDefaultSSLParameters` specifies that the returned parameters are a copy. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
