Search code examples
protocolsjakarta-mailtls1.3

How to use a particular protocol for javamail?


There is a javamail protocol property

mail.smtp.ssl.protocols

This allows the user to use a particular protocol (TLSv1.2 or 1.1).

What if the property is not used? Will it be then set by the JVM settings?

Also if I want to use TLSv1.3, what version of Javamail I would have to use?

Thanks


Solution

  • In javamail versions below 1.5.3 if the sysprop is not set it uses TLSv1.0, which (1) doesn't work at all on recent versions of Java and (2) won't work with increasingly many servers because 1.0 was sort of 'broken' briefly by BEAST and many authorities no longer permit it. See postfix and openJDK 11: "No appropriate protocol (protocol is disabled or cipher suites are inappropriate)" especially the section of my answer marked EDIT.

    On more recent versions, as you can see in the source linked there, it uses the JVM defaults except it removes SSL versions if present -- and all versions of Java since 2015 have omitted SSLv3 from JVM defaults (because it is really broken by POODLE). (SSLv2Hello, which wasn't an actual protocol version anyway, was removed even earlier.)

    To use TLSv1.3 you need a version of Java that supports it: 11 up or 8u261 up, or any non-absurd Java version with a recent enough version of BouncyCastle's BCTLS installed and configured instead of or at least before JSSE -- and of course a server that supports it. Javamail just passes this setting through to JSSE or BCTLS as a set of character strings, it doesn't need new code for different versions of TLS including 1.3.