[
https://issues.apache.org/jira/browse/GERONIMO-6792?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17243205#comment-17243205
]
Richard Zowalla commented on GERONIMO-6792:
-------------------------------------------
Based on the discussion on the mailing list and the comments by [~b.eckenfels],
I have provided an alternative diff (*GERONIMO-6792-v4-no-hardcoding.diff*),
which uses the enabled protocols of the SSLSockets *as is* (and logs them as
debug output).
Reason(s):
* SSLSocket might be created by a custom factory. Consequently, we shouldn't
simply override the enabled protocols by a static list.
* In the most common case (no custom factory), the SSLSocket is created with
JVM defaults, which are continously updated. Thx [~b.eckenfels] for the hint.
> Fix hard-coded TLSv1 version in MailConnection.java for Java Mail 1.6
> ---------------------------------------------------------------------
>
> Key: GERONIMO-6792
> URL: https://issues.apache.org/jira/browse/GERONIMO-6792
> Project: Geronimo
> Issue Type: Bug
> Security Level: public(Regular issues)
> Components: mail
> Reporter: Richard Zowalla
> Priority: Major
> Attachments: GERONIMO-6792-v4-no-hardcoding.diff,
> GERONIMO-6792-v4.diff
>
>
> Hi,
> I encountered some issues when using Geronimo Java Mail 1.6 (1.0.0) bundled
> with TomEE 8.0.5. The related thread [1] can be found on the
> [[email protected]|mailto:[email protected]] Mailing-List.
> In short:
> * Our mail server does only support TLS 1.2 or TLS 1.3
> * Geronimo Java Mail 1.6 in version 1.0.0 has TLS 1.0 hard-coded in the
> source and does not use the default protocols or the specified ones via
> *mail.smtp.ssl.protocols* for a TLS connection.
> I have attached a patch created via SVN DIFF.
> [1] [https://www.mail-archive.com/[email protected]/msg17544.html]
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
