Skip to content

TLSv1.3 support for Cloudstack #12784

Description

@mbertolina

The required feature described as a wish

Is there a plan to support TLSv1.3 on Cloudstack environment (Management server, agent, SystemVM templates).

Current CLOUDSTACK VERSION: 4.22
Component name: Management server, agent, SystemVM template, APIs.

From what I can see (if I am not wrong), TLSv1.2 is the only version supported.
https://github.com/apache/cloudstack/blob/main/utils/src/main/java/org/apache/cloudstack/utils/security/SSLUtils.java#L69

When forcing java runtime environment to use TLSv1.3 only on both management server and host side using update-crypto-policies on RHEL9, cloudstack agent sends TLSv1.2 on the TLS hello message, making TLS session not possible, reporting the following error messages:

#  java -XshowSettings:security:all -version
:
    Security TLS configuration (SunJSSE provider):
        Enabled Protocols:
            TLSv1.3

        Enabled Cipher Suites:
            TLS_AES_256_GCM_SHA384
            TLS_AES_128_GCM_SHA256
            TLS_CHACHA20_POLY1305_SHA256

openjdk version "21.0.10" 2026-01-20 LTS
OpenJDK Runtime Environment (Red_Hat-21.0.10.0.7-1) (build 21.0.10+7-LTS)
OpenJDK 64-Bit Server VM (Red_Hat-21.0.10.0.7-1) (build 21.0.10+7-LTS, mixed mode, sharing)
# 
# tail -f /var/log/cloudstack/agent/agent.log
:
2026-03-06 13:59:04,994 INFO  [utils.nio.Link] (main:[]) (logid:) Conf file found: /etc/cloudstack/agent/agent.properties
2026-03-06 13:59:05,020 ERROR [utils.nio.NioClient] (main:[]) (logid:) IOException while connecting to 108.145.116.84:8250 javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at java.base/sun.security.ssl.HandshakeContext.<init>(HandshakeContext.java:163)
        at java.base/sun.security.ssl.ClientHandshakeContext.<init>(ClientHandshakeContext.java:103)
        at java.base/sun.security.ssl.TransportContext.kickstart(TransportContext.java:252)
        at java.base/sun.security.ssl.SSLEngineImpl.beginHandshake(SSLEngineImpl.java:107)
        at com.cloud.utils.nio.NioClient.init(NioClient.java:73)
        at com.cloud.utils.nio.NioConnection.start(NioConnection.java:109)
        at com.cloud.agent.Agent.start(Agent.java:338)
        at com.cloud.agent.AgentShell.launchNewAgent(AgentShell.java:477)
        at com.cloud.agent.AgentShell.launchAgentFromClassInfo(AgentShell.java:454)
        at com.cloud.agent.AgentShell.launchAgent(AgentShell.java:438)
        at com.cloud.agent.AgentShell.start(AgentShell.java:539)
        at com.cloud.agent.AgentShell.main(AgentShell.java:569)

2026-03-06 13:59:05,020 ERROR [utils.nio.NioClient] (main:[]) (logid:) Unable to initialize the threads. javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at java.base/sun.security.ssl.HandshakeContext.<init>(HandshakeContext.java:163)
        at java.base/sun.security.ssl.ClientHandshakeContext.<init>(ClientHandshakeContext.java:103)
        at java.base/sun.security.ssl.TransportContext.kickstart(TransportContext.java:252)
        at java.base/sun.security.ssl.SSLEngineImpl.beginHandshake(SSLEngineImpl.java:107)
        at com.cloud.utils.nio.NioClient.init(NioClient.java:73)
        at com.cloud.utils.nio.NioConnection.start(NioConnection.java:109)
        at com.cloud.agent.Agent.start(Agent.java:338)
        at com.cloud.agent.AgentShell.launchNewAgent(AgentShell.java:477)
        at com.cloud.agent.AgentShell.launchAgentFromClassInfo(AgentShell.java:454)
        at com.cloud.agent.AgentShell.launchAgent(AgentShell.java:438)
        at com.cloud.agent.AgentShell.start(AgentShell.java:539)
        at com.cloud.agent.AgentShell.main(AgentShell.java:569)

2026-03-06 13:59:05,020 INFO  [utils.nio.NioClient] (main:[]) (logid:) NioClient connection closed
2026-03-06 13:59:05,020 INFO  [cloud.agent.Agent] (main:[]) (logid:) Attempted to connect to the server, but received an unexpected exception, trying again... com.cloud.utils.exception.NioConnectionException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at com.cloud.utils.nio.NioConnection.start(NioConnection.java:115)
        at com.cloud.agent.Agent.start(Agent.java:338)
        at com.cloud.agent.AgentShell.launchNewAgent(AgentShell.java:477)
        at com.cloud.agent.AgentShell.launchAgentFromClassInfo(AgentShell.java:454)
        at com.cloud.agent.AgentShell.launchAgent(AgentShell.java:438)
        at com.cloud.agent.AgentShell.start(AgentShell.java:539)
        at com.cloud.agent.AgentShell.main(AgentShell.java:569)
Caused by: javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
        at java.base/sun.security.ssl.HandshakeContext.<init>(HandshakeContext.java:163)
        at java.base/sun.security.ssl.ClientHandshakeContext.<init>(ClientHandshakeContext.java:103)
        at java.base/sun.security.ssl.TransportContext.kickstart(TransportContext.java:252)
        at java.base/sun.security.ssl.SSLEngineImpl.beginHandshake(SSLEngineImpl.java:107)
        at com.cloud.utils.nio.NioClient.init(NioClient.java:73)
        at com.cloud.utils.nio.NioConnection.start(NioConnection.java:109)
        ... 6 more
#

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions