[ https://issues.apache.org/jira/browse/NIFI-8630?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17369594#comment-17369594 ]
ASF subversion and git services commented on NIFI-8630: ------------------------------------------------------- Commit 786f17182b11cfd5ea28678853a4d401a51c6aff in nifi's branch refs/heads/main from David Handermann [ https://gitbox.apache.org/repos/asf?p=nifi.git;h=786f171 ] NIFI-8630 Upgraded javax.mail 1.4.7 to jakarta.mail 2.0.1 for PutEmail - Added jakarata.activation 2.0.1 to support jakarta.mail 2.0.1 - Clarified description of SMTP TLS property enabling STARTTLS NIFI-8630 Added final to several variables and adjusted variable declaration Signed-off-by: Pierre Villard <pierre.villard...@gmail.com> This closes #5179. > PutEmail fails to negotiate TLS1.2 with latest JDK. > ---------------------------------------------------- > > Key: NIFI-8630 > URL: https://issues.apache.org/jira/browse/NIFI-8630 > Project: Apache NiFi > Issue Type: Bug > Affects Versions: 1.13.2 > Reporter: Branko Peshevski > Assignee: David Handermann > Priority: Critical > Labels: SMTP, TLS, TLSv1.2, dependency-upgrade > Time Spent: 40m > Remaining Estimate: 0h > > On April 20, 2021 with the latest JDK the support for TLS 1.0 and 1.1 was > removed/disabled. Using the PutEmail processor with the latest OpenJdk and > TLS set to true is failing with: > {code:java} > Failed to send email for > StandardFlowFileRecord[uuid=7e8d3482-59ac-4993-a9ea-fa9089ced554,claim=,offset=0,name=7e8d3482-59ac-4993-a9ea-fa9089ced554,size=0]: > Could not convert socket to TLS; routing to failure: > javax.mail.MessagingException: Could not convert socket to TLS; > nested exception is: > javax.net.ssl.SSLHandshakeException: No appropriate protocol > (protocol is disabled or cipher suites are inappropriate) > javax.mail.MessagingException: Could not convert socket to TLS > at com.sun.mail.smtp.SMTPTransport.startTLS(SMTPTransport.java:1907) > at > com.sun.mail.smtp.SMTPTransport.protocolConnect(SMTPTransport.java:666) > at javax.mail.Service.connect(Service.java:317) > at javax.mail.Service.connect(Service.java:176) > at javax.mail.Service.connect(Service.java:125) > at javax.mail.Transport.send0(Transport.java:194) > at javax.mail.Transport.send(Transport.java:124) > at > org.apache.nifi.processors.standard.PutEmail.send(PutEmail.java:541) > at > org.apache.nifi.processors.standard.PutEmail.onTrigger(PutEmail.java:395) > at > org.apache.nifi.processor.AbstractProcessor.onTrigger(AbstractProcessor.java:27) > at > org.apache.nifi.controller.StandardProcessorNode.onTrigger(StandardProcessorNode.java:1173) > at > org.apache.nifi.controller.tasks.ConnectableTask.invoke(ConnectableTask.java:214) > at > org.apache.nifi.controller.scheduling.TimerDrivenSchedulingAgent$1.run(TimerDrivenSchedulingAgent.java:117) > at org.apache.nifi.engine.FlowEngine$2.run(FlowEngine.java:110) > {code} > From my research the javax.mail version is quite old and it is known that > 1.4.x fails to renegotiate with better tls algorithm. But I think it would be > better to add new Property Descriptor to the PutEmail processor that will > default the ssl protocol to TLS1.2. > * Update the javax.mail dependency. > * Add PropertyDescriptor for setting the ssl algorithm that will default to > TLS 1.2 -- This message was sent by Atlassian Jira (v8.3.4#803005)