Can TLS Renegotiation be Disabled?

Applies To

Java SE JDK and JRE - Version 8 and above Any platform

Java does not provide a built-in property to explicitly disable TLS renegotiation for either clients or servers. However, a server can reject client-initiated renegotiation requests by setting jdk.tls.rejectClientInitiatedRenegotiation=true. There are several ways to set a Java security property as documented in the Java Secure Socket Extension (JSSE) Reference Guide

Note: Renegotiation is not possible when TLS 1.3 has been negotiated, and TLS 1.3 is the default protocol in JDK. See RFC 8446 The Transport Layer Security (TLS) Protocol Version 1.3 for details.

Last reviewed on Sat Feb 01 2025 00:00:00 GMT+0000 (Coordinated Universal Time)