Project: mule
Issue MULE-7090: Make Mule rely on platform configured JCE provider instead of fixing on a predefined version
TlsConfiguration gets defaults for several properties using an AutoDiscoverySecurityProviderFactory, which in turn provides defaults based on the JVM flavour in use. In particular, it sets the default JCE Provider to use, the JCE Provider implementation class, the default Keystore type, and the default SSL protocol type being use. This has several problems: * It doesn't allow to properly setup JCE providers as part of the platform configuration, something required to use a FIPS 140-2 compliant JCE provider * It fixes on old versions of the providers and doesn't leverage improvements made in the platforms, like IBM's improved JCE driver (currently we use a JCE provider that is 6+ years old on IBM JVMs) * It fixes the SSL/TLS versions supported, which causes SSL endpoints to support SSL3 (considered deprecated) but no TLS The java platform provides sensible defaults for all these, which get updated as the security landscape evolves, and which can be defined as part of the JVM configuration. Remove the "discovery" of defaults, and use platform defaults for operations in and depending on TlsConfiguration. Acceptance criteria: It should be possible to use any JCE provider defined in the JVM environment in order to support FIPS compliant providers. Endpoints should rely on the registered JCE provider for SSL and use the default ssl type instead of hardcoding one (As FIPS providers will disable several modes and only allow TLS 1.0+).
Story points: 5