I'm writing Java code for a decentralized network. (Proof of concept code here.) Each node generates its own self-signed certificate, to be used both server-side and client-side in every connection. Current key choice is 4096 bit RSA. I figured I'd use TLSv1.3, since AFAICT that's most secure (though only marginally moreso than TLSv1.2). I get an sslContext via SSLContext.getInstance("TLSv1.3"). I notice, though, that once I call SSLEngine se = sslContext.createSSLEngine(), se.getEnabledProtocols() returns "TLSv1.3", "TLSv1.2", and "SSLv2Hello". Is it advisable to set the enabled protocols strictly to TLSv1.3, since I control both sides of the connection? Or would that expose me to surprise bugs/vulnerabilities/whatever?
On a similar note, should I / should I not pick a specific set of enabled cipher suites?
