Enforce a TLS 1.3 floor in YAML files
io.moderne.cryptography.pqc.EnforceTls13YamlArtifactio.moderne.recipe:rewrite-cryptographyRewrites TLS protocol configuration in YAML files to a TLS 1.3 floor, so that JEP 527 hybrid key exchange — which exists for TLS 1.3 only — can negotiate. Covers server.ssl.enabled-protocols, the jdk.tls.client.protocols, jdk.tls.server.protocols and https.protocols keys, server.ssl.protocol under strictAlgorithmName, and any key named in additionalPropertyKeys. Values may be a single scalar, a comma-separated scalar, or a sequence in flow or block style; a sequence is rewritten in place, reusing its existing entries so indentation and comments survive. Configuration a source scan cannot see — config servers, ConfigMap overlays, environment variables — is out of scope, so an unchanged repository is not evidence of an enforced floor.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe io.moderne.cryptography.pqc.EnforceTls13YamlIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:rewrite-cryptography:RELEASEOptions
| Name | Type | Description |
|---|---|---|
minimumProtocol | String | The protocol floor to enforce globally: TLSv1.3 (the default) strips TLSv1.2 from every enumerated protocol list, TLSv1.2 retains it everywhere. Use retainTls12In instead when only some configuration files need the exception.e.g. TLSv1.2 |
retainTls12In | List | Globs naming the configuration files that keep TLSv1.2 in their rewritten protocol lists, matched against the source path. SSLv2Hello, SSLv3, TLSv1 and TLSv1.1 are still stripped inside a matched file, and TLSv1.3 is still ensured present.e.g. **/application-legacy.yml |
strictAlgorithmName | Boolean | Also rewrite server.ssl.protocol when it names a version-flexible algorithm — TLS or Default — to TLSv1.3. Off by default: Spring Boot passes this value to SSLContext.getInstance, where those names already permit TLS 1.3. A value naming a version below 1.3 is rewritten either way, because such a context can never negotiate TLS 1.3. |
additionalPropertyKeys | List | Configuration keys beyond the built-in ones whose values enumerate TLS protocol versions. Matched with Spring relaxed binding against the dotted path of the mapping entry, so my.tls.enabled-protocols also matches my.tls.enabledProtocols.e.g. my.service.tls-protocols |
Data tables
Structured output this recipe can produce.
- TLS protocol enforcementProtocol configuration surfaces rewritten to a TLS 1.3 floor, and surfaces flagged as needing manual review because rewriting them would change behaviour in a way a source scan cannot justify. Rows describe declared configuration only: a JVM's `java.security` file, container `-D` flags and environment variables are invisible here, so an enforced source does not prove an enforced runtime.
io.moderne.cryptography.pqc.table.ProtocolEnforcementTable - Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats