WSO2 APIM v3.2 | TLSv1.3 support for endpoint URL

Recently we have come across a requirement where the endpoint URL security has been upgraded from TLSv1.2 to TLSv1.3 and our API integration got broken with WSO2 APIM v3.2. Below is the summary of the incident and how I overcome this situation with support.

Environment- WSO2 API Manager v3.2.0.221, RHEL 8.3, OpenJDK1.8.291

Problem Statement- API based integration got broken due to endpoint URL TLS upgrade to TLSv1.3. while WSO2 API Manager has a support with TLS1.2 only. We got the error as mentioned below-

 ERROR {org.apache.synapse.transport.passthru.TargetHandler} - I/O error: Received fatal alert: protocol_version javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version
        at sun.security.ssl.Alert.createSSLException(Alert.java:131)
        at sun.security.ssl.Alert.createSSLException(Alert.java:117)
        at sun.security.ssl.TransportContext.fatal(TransportContext.java:311)
        at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293)
        at sun.security.ssl.TransportContext.dispatch(TransportContext.java:185)
        at sun.security.ssl.SSLTransport.decode(SSLTransport.java:152)
        at sun.security.ssl.SSLEngineImpl.decode(SSLEngineImpl.java:575)
        at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:531)
        at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:398)
        at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:377)
        at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:626)

Root Cause- The outgoing TLS is v1.2 while the endpoint supports TLSv1.3 hence there is a version mismatch resulting in SSL handshake failure

The Solution- There are 2 possible solutions to overcome this problem-

1. Quick and Easy: Ask the API provider to enable TLSv1.2 support

2. Permanent Solution: Apply the following changes in WSO2 APIM environment-

• Upgrade the OpenJDK to level 392 (OpenJDk1.8.392) as this patch level supports TLSv1.3
• Stop the server (Gateway Node) and add below configuration in deployment.toml file

        [transport.passthru_https.sender.parameters]
        HttpsProtocols = "TLSv1,TLSv1.1,TLSv1.2,TLSv1.3"

Start the Server and Test the API. It should now work on outgoing  traffic with TLSv1.3 support.

Recommendation- As per ongoing effort to strengthen the transport level security, we must enable TLSv1.3 or plan a roadmap towards TLSv1.3 support in our application.