Enforce a TLS 1.3 floor in YAML files
ProprietaryRewrites TLS protocol configuration in YAML files to a TLS 1.3 floor, so that JEP 527 hybrid key exchange — which exists for TLS 1.3 only — can negotiate. Covers server.ssl.enabled-protocols, the jdk.tls.client.protocols, jdk.tls.server.protocols and https.protocols keys, server.ssl.protocol under strictAlgorithmName, and any key named in additionalPropertyKeys. Values may be a single scalar, a comma-separated scalar, or a sequence in flow or block style; a sequence is rewritten in place, reusing its existing entries so indentation and comments survive. Configuration a source scan cannot see — config servers, ConfigMap overlays, environment variables — is out of scope, so an unchanged repository is not evidence of an enforced floor.
io.Optional
The protocol floor to enforce globally: TLSv1.3 (the default) strips TLSv1.2 from every enumerated protocol list, TLSv1.2 retains it everywhere. Use retainTls12In instead when only some configuration files need the exception.
Globs naming the configuration files that keep TLSv1.2 in their rewritten protocol lists, matched against the source path. SSLv2Hello, SSLv3, TLSv1 and TLSv1.1 are still stripped inside a matched file, and TLSv1.3 is still ensured present. Separate values with commas.
Also rewrite server.ssl.protocol when it names a version-flexible algorithm — TLS or Default — to TLSv1.3. Off by default: Spring Boot passes this value to SSLContext.getInstance, where those names already permit TLS 1.3. A value naming a version below 1.3 is rewritten either way, because such a context can never negotiate TLS 1.3.
Configuration keys beyond the built-in ones whose values enumerate TLS protocol versions. Matched with Spring relaxed binding against the dotted path of the mapping entry, so my.tls.enabled-protocols also matches my.tls.enabledProtocols. Separate values with commas.
mod run .Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.