Skip to content
ecdsa.com
Java (JSSE)Java

Error message

javax.net.ssl.SSLHandshakeException: (protocol_version) Received fatal alert: protocol_version

Also printed as

  • javax.net.ssl.SSLHandshakeException: Received fatal alert: protocol_version

JDK 21 and later include the alert name in parentheses. If the server instead picks a version the JVM refuses, Java says "The server selected protocol version TLS10 is not accepted by client preferences [TLS13, TLS12]".

Java (JSSE) — TLS alert 70 received from the server

What it means

The server refused the TLS versions the JVM offered and answered with alert 70 (protocol_version). Current JDKs offer TLS 1.3 and 1.2 only (1.0 and 1.1 are in jdk.tls.disabledAlgorithms), so a server limited to the old versions has no common version with them.

Why it happens

How to fix it

  1. 1.

    Find the versions the server accepts

    Probe each version with openssl s_client; then fix whichever side is outdated.

    bash
    for v in tls1 tls1_1 tls1_2 tls1_3; do
  printf '%-7s ' "$v"
  echo | openssl s_client -connect legacy.example.com:443 -servername legacy.example.com -"$v" \
    -cipher 'DEFAULT:@SECLEVEL=0' >/dev/null 2>&1 && echo accepted || echo refused
done
  2. 2.

    Remove protocol pins on the client

    Look for https.protocols or jdk.tls.client.protocols in start scripts and JVM options; allow TLSv1.3 and TLSv1.2.

    bash
    # Do not pin old versions on the client; let JSSE offer 1.3 and 1.2
grep -rn 'https.protocols\|jdk.tls.client.protocols' /etc/default/app* "$JAVA_HOME/conf" 2>/dev/null
java -Djdk.tls.client.protocols=TLSv1.3,TLSv1.2 -jar app.jar
  3. 3.

    Enable TLS 1.2 and 1.3 on the server

    The durable fix: every maintained client supports them.

    text
    # Server side: enable TLS 1.2 and 1.3
ssl_protocols TLSv1.2 TLSv1.3;

Related errors

Browse the full signature error database