This is an automated email from the ASF dual-hosted git repository.
gaborgsomogyi pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push:
new 1690c6bed94 [FLINK-40801][security] Enable TLS 1.3 in default SSL
protocol and cipher suites
1690c6bed94 is described below
commit 1690c6bed94d402eeb84a47066cc7aec636f9610
Author: Gabor Somogyi <[email protected]>
AuthorDate: Fri Sep 25 19:44:57 2026 +0200
[FLINK-40801][security] Enable TLS 1.3 in default SSL protocol and cipher
suites
---
docs/content.zh/docs/deployment/security/security-ssl.md | 4 +++-
docs/content/docs/deployment/security/security-ssl.md | 4 +++-
docs/layouts/shortcodes/generated/security_configuration.html | 4 ++--
docs/layouts/shortcodes/generated/security_ssl_section.html | 4 ++--
.../main/java/org/apache/flink/configuration/SecurityOptions.java | 4 ++--
.../java/org/apache/flink/configuration/SecurityOptionsTest.java | 8 ++++++--
flink-end-to-end-tests/test-scripts/common_ssl.sh | 3 ++-
7 files changed, 20 insertions(+), 11 deletions(-)
diff --git a/docs/content.zh/docs/deployment/security/security-ssl.md
b/docs/content.zh/docs/deployment/security/security-ssl.md
index 36179b3b786..c988d2b244b 100644
--- a/docs/content.zh/docs/deployment/security/security-ssl.md
+++ b/docs/content.zh/docs/deployment/security/security-ssl.md
@@ -156,11 +156,13 @@ In response to evolving security standards and to ensure
compatibility with mode
To support these secure-by-default JDK versions and align with best practices,
Flink's default value for `security.ssl.algorithms` is now:
-`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
+`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384`
This default provides strong security and wide compatibility. You can
customize the cipher suites using the `security.ssl.algorithms` configuration
option if your environment has different requirements.
If these cipher suites are not supported on your setup, you will see that
Flink processes will not be able to connect to each other.
+Flink's default `security.ssl.protocol` also includes TLS 1.3
(`TLSv1.2,TLSv1.3`), and the default cipher list above includes TLS 1.3's own
suites (`TLS_AES_128_GCM_SHA256`, `TLS_AES_256_GCM_SHA384`) alongside the TLS
1.2 suites. Both endpoints negotiate the highest protocol version they have in
common that also has a matching cipher suite, so deployments use TLS 1.3
automatically when possible and fall back to TLS 1.2 when a peer does not
support it. No configuration change is required [...]
+
### Complete List of SSL Options
{{< generated/security_configuration >}}
diff --git a/docs/content/docs/deployment/security/security-ssl.md
b/docs/content/docs/deployment/security/security-ssl.md
index dca744ee3f2..64888879396 100644
--- a/docs/content/docs/deployment/security/security-ssl.md
+++ b/docs/content/docs/deployment/security/security-ssl.md
@@ -156,11 +156,13 @@ In response to evolving security standards and to ensure
compatibility with mode
To support these secure-by-default JDK versions and align with best practices,
Flink's default value for `security.ssl.algorithms` is now:
-`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`
+`TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384`
This default provides strong security and wide compatibility. You can
customize the cipher suites using the `security.ssl.algorithms` configuration
option if your environment has different requirements.
If these cipher suites are not supported on your setup, you will see that
Flink processes will not be able to connect to each other.
+Flink's default `security.ssl.protocol` also includes TLS 1.3
(`TLSv1.2,TLSv1.3`), and the default cipher list above includes TLS 1.3's own
suites (`TLS_AES_128_GCM_SHA256`, `TLS_AES_256_GCM_SHA384`) alongside the TLS
1.2 suites. Both endpoints negotiate the highest protocol version they have in
common that also has a matching cipher suite, so deployments use TLS 1.3
automatically when possible and fall back to TLS 1.2 when a peer does not
support it. No configuration change is required [...]
+
### Complete List of SSL Options
{{< generated/security_configuration >}}
diff --git a/docs/layouts/shortcodes/generated/security_configuration.html
b/docs/layouts/shortcodes/generated/security_configuration.html
index 757e8ff979d..00833c45cf8 100644
--- a/docs/layouts/shortcodes/generated/security_configuration.html
+++ b/docs/layouts/shortcodes/generated/security_configuration.html
@@ -100,7 +100,7 @@
</tr>
<tr>
<td><h5>security.ssl.algorithms</h5></td>
- <td style="word-wrap:
break-word;">"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"</td>
+ <td style="word-wrap:
break-word;">"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384"</td>
<td>String</td>
<td>The comma separated list of standard SSL algorithms to be
supported. Read more <a
href="https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#jsse-cipher-suite-names";>here</a></td>
</tr>
@@ -184,7 +184,7 @@
</tr>
<tr>
<td><h5>security.ssl.protocol</h5></td>
- <td style="word-wrap: break-word;">"TLSv1.2"</td>
+ <td style="word-wrap: break-word;">"TLSv1.2,TLSv1.3"</td>
<td>String</td>
<td>The comma separated list of SSL protocol versions to be
supported for the ssl transport, e.g. <code
class="highlighter-rouge">TLSv1.2,TLSv1.3</code>. The highest protocol version
supported by both communication endpoints and for which a matching cipher suite
is available (see <code
class="highlighter-rouge">security.ssl.algorithms</code>) is negotiated; the
connection fails only if none of the listed protocols has a matching cipher
suite.</td>
</tr>
diff --git a/docs/layouts/shortcodes/generated/security_ssl_section.html
b/docs/layouts/shortcodes/generated/security_ssl_section.html
index 7df25d3fd63..2a5bcda6ac7 100644
--- a/docs/layouts/shortcodes/generated/security_ssl_section.html
+++ b/docs/layouts/shortcodes/generated/security_ssl_section.html
@@ -10,7 +10,7 @@
<tbody>
<tr>
<td><h5>security.ssl.algorithms</h5></td>
- <td style="word-wrap:
break-word;">"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"</td>
+ <td style="word-wrap:
break-word;">"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384"</td>
<td>String</td>
<td>The comma separated list of standard SSL algorithms to be
supported. Read more <a
href="https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#jsse-cipher-suite-names";>here</a></td>
</tr>
@@ -70,7 +70,7 @@
</tr>
<tr>
<td><h5>security.ssl.protocol</h5></td>
- <td style="word-wrap: break-word;">"TLSv1.2"</td>
+ <td style="word-wrap: break-word;">"TLSv1.2,TLSv1.3"</td>
<td>String</td>
<td>The comma separated list of SSL protocol versions to be
supported for the ssl transport, e.g. <code
class="highlighter-rouge">TLSv1.2,TLSv1.3</code>. The highest protocol version
supported by both communication endpoints and for which a matching cipher suite
is available (see <code
class="highlighter-rouge">security.ssl.algorithms</code>) is negotiated; the
connection fails only if none of the listed protocols has a matching cipher
suite.</td>
</tr>
diff --git
a/flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java
b/flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java
index 441b07f569e..30fd670a49d 100644
---
a/flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java
+++
b/flink-core/src/main/java/org/apache/flink/configuration/SecurityOptions.java
@@ -508,7 +508,7 @@ public class SecurityOptions {
public static final ConfigOption<String> SSL_PROTOCOL =
key("security.ssl.protocol")
.stringType()
- .defaultValue("TLSv1.2")
+ .defaultValue("TLSv1.2,TLSv1.3")
.withDescription(
Description.builder()
.text(
@@ -533,7 +533,7 @@ public class SecurityOptions {
key("security.ssl.algorithms")
.stringType()
.defaultValue(
-
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384")
.withDescription(
Description.builder()
.text(
diff --git
a/flink-core/src/test/java/org/apache/flink/configuration/SecurityOptionsTest.java
b/flink-core/src/test/java/org/apache/flink/configuration/SecurityOptionsTest.java
index 34ac0160bf6..870da24ae85 100644
---
a/flink-core/src/test/java/org/apache/flink/configuration/SecurityOptionsTest.java
+++
b/flink-core/src/test/java/org/apache/flink/configuration/SecurityOptionsTest.java
@@ -25,7 +25,6 @@ import static org.assertj.core.api.Assertions.assertThat;
class SecurityOptionsTest {
/** Tests whether activation of internal / REST SSL evaluates the config
flags correctly. */
- @SuppressWarnings("deprecation")
@Test
void checkEnableSSL() {
// new options take precedence
@@ -63,6 +62,11 @@ class SecurityOptionsTest {
void checkDefaultCipherSuite() {
assertThat(SecurityOptions.SSL_ALGORITHMS.defaultValue())
.isEqualTo(
-
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384");
+
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384");
+ }
+
+ @Test
+ void checkDefaultProtocol() {
+
assertThat(SecurityOptions.SSL_PROTOCOL.defaultValue()).isEqualTo("TLSv1.2,TLSv1.3");
}
}
diff --git a/flink-end-to-end-tests/test-scripts/common_ssl.sh
b/flink-end-to-end-tests/test-scripts/common_ssl.sh
index b04aea6d6fa..2f8215c0f39 100644
--- a/flink-end-to-end-tests/test-scripts/common_ssl.sh
+++ b/flink-end-to-end-tests/test-scripts/common_ssl.sh
@@ -100,7 +100,8 @@ function _set_conf_ssl_helper {
fi
# adapt config
- set_config_key security.ssl.algorithms
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
+ set_config_key security.ssl.protocol "TLSv1.2,TLSv1.3"
+ set_config_key security.ssl.algorithms
"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384,TLS_AES_128_GCM_SHA256,TLS_AES_256_GCM_SHA384"
set_config_key security.ssl.provider ${provider}
set_config_key security.ssl.${type}.enabled true
set_config_key security.ssl.${type}.keystore ${ssl_dir}/node.keystore
