Using multiple TLS protocols gives warning in Spring Boot

Question

Properties:

server.ssl.enabled-protocols=TLSv1.2,TLSv1.3

Output warning:

o.apache.tomcat.util.net.SSLHostConfig : The protocol [TLSv1.2] was added to the list of protocols on the SSLHostConfig named [default]. Check if a +/- prefix is missing.

[TLSv1.2] is replaced with [TLSv1.3] depedning on order.

Any clue how to fix this?

Answer 1

It is "just" warning. Tomcat used to use a , as the separator but changed to using a + and a - to indicate to add or remove the protocol. Regardless of the warning it will still work as it should.

See the following comment from the Tomcat source code.

// List of protocol names, separated by ",", "+" or "-".
// Semantics is adding ("+") or removing ("-") from left
// to right, starting with an empty protocol set.
// Tokens are individual protocol names or "all" for a
// default set of supported protocols.
// Separator "," is only kept for compatibility and has the
// same semantics as "+", except that it warns about a potentially
// missing "+" or "-".

Spring Boot will call the setProtocols of the SSLHostConfig using a single string, it will concat the array of String in ServerProperties using a , . Hence a warning will be emitted by Tomcat.

You can replace the , with a + in your configuration to prevent the warning.