Resolving TLS 1.2/1.3 Issues with Amazon SDK on JDK 11

Discover how to fix connection issues using Amazon SDK with JDK 11 by configuring TLS settings for smoother communication.
---
This video is based on the question https://stackoverflow.com/q/68624830/ asked by the user 'Nicolas' ( https://stackoverflow.com/u/3819891/ ) and on the answer https://stackoverflow.com/a/68669977/ provided by the user 'Nicolas' ( https://stackoverflow.com/u/3819891/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Requesting S3-compatible service using Amazon SDK with jdk11 (works with jdk8) (TLS 1.2/1.3 problem)

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to write me at vlogize [AT] gmail [DOT] com.
---
Troubleshooting Amazon SDK Connection Issues on JDK 11 with TLS Settings

In today's world of cloud computing, integrating different services and APIs is a common requirement for developers. One popular service is Amazon S3, which allows you to store and retrieve data via a scalable and robust interface. However, there are instances where developers face challenges when transitioning their applications to newer Java versions, particularly when using the AWS Java SDK. This post focuses on addressing a specific problem encountered when attempting to use the Amazon SDK with JDK 11, which works seamlessly with JDK 8 but results in connection failures due to TLS issues.

The Problem

When attempting to run a microservice that utilizes the Amazon SDK (specifically version 1.12.12) with OpenJ9 JDK 11, a user experienced a connection failure with the following error message:

[[See Video to Reveal this Text or Code Snippet]]

This issue arises when running tests for a service compatible with Amazon S3 behind a proxy. The stack trace revealed a NoHttpResponseException, indicating that the server was not responding properly. The error indicates that while the configured service works well with JDK 8, JDK 11 presents connectivity challenges that need to be addressed.

Understanding the Root Cause

The root of this issue can be linked to the default TLS settings employed by JDK 11, which by default may utilize TLS 1.3. Some servers, particularly certain Amazon S3-compatible servers, may not support TLS 1.3, potentially leading to communication failures.

The Solution: Configuring TLS to Use Version 1.2

To resolve this issue, configuring the Amazon SDK client to enforce the use of TLS 1.2 can be highly effective. Below is a step-by-step breakdown of how to implement this solution:

Step 1: Configure Client Settings

You'll want to set up a ClientConfiguration for your Amazon S3 client to specify your proxy details:

[[See Video to Reveal this Text or Code Snippet]]

Step 2: Setup SSL Configuration for TLS 1.2

Next, create an SSLConnectionSocketFactory that is configured to accept only TLS 1.2 connections:

[[See Video to Reveal this Text or Code Snippet]]

Step 3: Build the Amazon S3 Client

After configuring the connection settings, build your Amazon S3 client:

[[See Video to Reveal this Text or Code Snippet]]

Final Thoughts

By ensuring your Amazon SDK is set to use TLS 1.2, developers can avoid connectivity issues that arise due to differences in how TLS is managed between JDK versions. This solution brings smoother performance and reliability, particularly when interacting with different APIs behind a proxy.

Transitioning to newer versions of Java can sometimes create unforeseen challenges. However, with the right configuration, it is possible to maintain compatibility and perform necessary operations without major hiccups. If you face similar issues with Amazon SDK or other APIs behind a proxy, consider looking into TLS settings as a primary solution.

With these adjustments, you should now be able to work effectively with the Amazon SDK while utilizing JDK 11 seamlessly!