Repository: netty/netty
Issue: Netty SSL doesn't respect `-Djdk.tls.client.protocols`

### Expected behavior
`-Djdk.tls.client.protocols` should control Netty's SSL protocols

### Actual behavior

Netty checks if `TLSv1, TLSv1.1, TLSv1.2` are [supported against JDK's supported protocols](https://github.com/netty/netty/blob/39cc7a673939dec96258ff27f5b1874671838af0/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java#L103) which are hardcoded. 

### Steps to reproduce

### Minimal yet complete reproducer code (or URL to code)
```
System.setProperty("jdk.tls.client.protocols", "TLSv1.2");
SSLContext context = SSLContext.getInstance("TLS");
context.init(null, null, null);
SSLEngine engine = context.createSSLEngine();
// respect JVM flag: [TLSv1.2]
System.err.println("Default " + Arrays.toString(context.getDefaultSSLParameters().getProtocols())); 
// used by Netty, don't respect JVM flag: [SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2]
System.err.println("Supported " + Arrays.toString(engine.getSupportedProtocols()));
```
### Netty version

4.0.56

### JVM version (e.g. `java -version`)

1.8.0_162

### OS version (e.g. `uname -a`)

`dev machine`: 18.6.0 Darwin Kernel Version 18.6.0: Thu Apr 25 23:16:27 PDT 2019; root:xnu-4903.261.4~2/RELEASE_X86_64 x86_64

Issue comments:
@jasonstack want to provide a PR against 4.1 branch ?
@normanmaurer  sure. I will submit a PR..
@jasonstack cool... please also ensure you sign the ICLA: https://netty.io/s/icla 

Pull request review comments:

Patch that resolved the issue:
diff --git a/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java b/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java
index eb128fe80e7..0e9a1273831 100644
--- a/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java
+++ b/handler/src/main/java/io/netty/handler/ssl/JdkSslContext.java
@@ -79,7 +79,7 @@ public class JdkSslContext extends SslContext {
         DEFAULT_PROVIDER = context.getProvider();
 
         SSLEngine engine = context.createSSLEngine();
-        DEFAULT_PROTOCOLS = defaultProtocols(engine);
+        DEFAULT_PROTOCOLS = defaultProtocols(context, engine);
 
         SUPPORTED_CIPHERS = Collections.unmodifiableSet(supportedCiphers(engine));
         DEFAULT_CIPHERS = Collections.unmodifiableList(defaultCiphers(engine, SUPPORTED_CIPHERS));
@@ -98,9 +98,9 @@ public class JdkSslContext extends SslContext {
         }
     }
 
-    private static String[] defaultProtocols(SSLEngine engine) {
-        // Choose the sensible default list of protocols.
-        final String[] supportedProtocols = engine.getSupportedProtocols();
+    private static String[] defaultProtocols(SSLContext context, SSLEngine engine) {
+        // Choose the sensible default list of protocols that respects JDK flags, eg. jdk.tls.client.protocols
+        final String[] supportedProtocols = context.getDefaultSSLParameters().getProtocols();
         Set<String> supportedProtocolsSet = new HashSet<String>(supportedProtocols.length);
         Collections.addAll(supportedProtocolsSet, supportedProtocols);
         List<String> protocols = new ArrayList<String>();
@@ -261,7 +261,7 @@ public JdkSslContext(SSLContext sslContext,
             SSLEngine engine = sslContext.createSSLEngine();
             try {
                 if (protocols == null) {
-                    this.protocols = defaultProtocols(engine);
+                    this.protocols = defaultProtocols(sslContext, engine);
                 } else {
                     this.protocols = protocols;
                 }


Test patch: