Feature
Changed the TLS defaults on Message Processors to the Java 21 cryptographic baseline.
Changed the TLS defaults on Message Processors to the Java 21 cryptographic baseline.
Message Processors run on Java 21, which enables TLS 1.3 by default (JEP 332) and prefers it for outbound backend connections, falling back to TLS 1.2. No configuration change is required if your target servers and load balancers negotiate TLS 1.3, or negotiate TLS 1.2 with forward-secret (ECDHE) cipher suites.
Java 21 also disables the non-forward-secret static RSA key-exchange suites (TLS_RSA_*). If you have overridden conf_http_HTTPTransport.ssl.cipher.suites.whitelist or conf_message-processor-communication_local.http.ssl.ciphers with static RSA suites only, backend calls fail with no cipher suites in common and the Router cannot complete a TLS handshake with the Message Processor. Replace the TLS_RSA_* entries with modern cipher suites and restart the Message Processor.
For the remediation path, see Legacy backend requirements and remediation.
Read the original announcement