I'm writing Java code for a decentralized network. (Proof of concept code here.) Each node generates its own self-signed certificate, to be used both server-side and client-side in every connection. Current key choice is 4096 bit RSA. I figured I'd use TLSv1.3, since AFAICT that's most secure (though only marginally moreso than TLSv1.2). I get an sslContext via SSLContext.getInstance("TLSv1.3"). I notice, though, that once I call SSLEngine se = sslContext.createSSLEngine(), se.getEnabledProtocols() returns "TLSv1.3", "TLSv1.2", and "SSLv2Hello". Is it advisable to set the enabled protocols strictly to TLSv1.3, since I control both sides of the connection? Or would that expose me to surprise bugs/vulnerabilities/whatever?

On a similar note, should I / should I not pick a specific set of enabled cipher suites?

  • 8
    Forcing TLS1.3 if you control both server and client is good practice.
    – MechMK1
    Jan 5 at 3:51


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.