Skip to content
MtrXTools

javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)

Java has no TLS version it may use with this server

Seen in Java 8u291+ and 11+, JDBC drivers (MySQL, SQL Server), JavaMail, Spring

The Java client was left with no enabled TLS version or cipher suite to offer, usually because the only ones allowed are disabled in the JDK.

Common causes

  • The server or driver only supports TLS 1.0 or 1.1, which recent JDKs disable in jdk.tls.disabledAlgorithms.
  • An old JDBC driver or library that hard-codes TLSv1 or TLSv1.1.
  • Code that forces a single protocol the JDK does not allow.

How to fix it

  1. Upgrade the server to support TLS 1.2 or 1.3; this is the real fix.
  2. Update the JDBC driver or library, and set its TLS version option to TLSv1.2 or higher.
  3. Run with -Djavax.net.debug=ssl:handshake to see which protocols were disabled.
  4. Re-enabling TLS 1.0/1.1 in java.security weakens security; use it only briefly for a legacy server.

Got a different message? Paste it into the error explainer.

Related errors

All 32 Languages & runtimes errors