← All recipes
Moderne licensed

Enforce a TLS 1.3 floor

Recipe IDio.moderne.cryptography.pqc.EnforceTls13Artifactio.moderne.recipe:rewrite-cryptography

Rewrites JSSE, BouncyCastle and Spring Boot protocol configuration to a TLS 1.3 floor across Java, .properties and YAML sources, so that JEP 527 hybrid key exchange — which exists for TLS 1.3 only — can negotiate. Surfaces that cannot be rewritten safely are recorded as Report only rows rather than changed.

Composite recipeProprietary

Usage

This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.

mod run . --recipe io.moderne.cryptography.pqc.EnforceTls13

If the recipe isn’t available locally, install it with:

mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASE

Definition

This recipe runs the following recipes in order.

Data tables

Structured output this recipe can produce.

  • TLS protocol enforcementProtocol configuration surfaces rewritten to a TLS 1.3 floor, and surfaces flagged as needing manual review because rewriting them would change behaviour in a way a source scan cannot justify. Rows describe declared configuration only: a JVM's `java.security` file, container `-D` flags and environment variables are invisible here, so an enforced source does not prove an enforced runtime.io.moderne.cryptography.pqc.table.ProtocolEnforcementTable
  • Source files that had resultsSource files that were modified by the recipe run.org.openrewrite.table.SourcesFileResults
  • Source files that had search resultsSearch results that were found during the recipe run.org.openrewrite.table.SearchResults
  • Source files that errored on a recipeThe details of all errors produced by a recipe run.org.openrewrite.table.SourcesFileErrors
  • Recipe performanceStatistics used in analyzing the performance of recipes.org.openrewrite.table.RecipeRunStats