TLS 1.3 by default

TLS 1.3 is enabled by default — no explicit protocol configuration needed.

Code Comparison

✕ Java 8

SSLContext ctx =
    SSLContext.getInstance("TLSv1.2");
ctx.init(null, trustManagers, null);
SSLSocketFactory factory =
    ctx.getSocketFactory();
// Must specify protocol version

✓ Java 11+

// TLS 1.3 is the default!
var client = HttpClient.newBuilder()
    .sslContext(SSLContext.getDefault())
    .build();
// Already using TLS 1.3

Share 𝕏

See a problem with this code? Let us know.

Why the modern way wins

🛡️

More secure

TLS 1.3 removes obsolete cipher suites and handshake patterns.

⚡

Faster handshake

TLS 1.3 completes in one round trip vs two.

🆓

Zero config

Secure by default — no explicit protocol selection needed.

Old Approach

Manual TLS Config

Modern Approach

TLS 1.3 Default

Since JDK

Difficulty

Intermediate

JDK Support

TLS 1.3 by default

Available

Widely available since JDK 11 (Sept 2018)

How it works

Java 11 added TLS 1.3 support and made it the preferred protocol. The HttpClient uses it automatically. No more manually specifying protocol versions for secure connections.

PEM encoding/decoding

Java 8

String pem = "-----BEGIN CERTIFICATE-----\n"
    + Base64.getMimeEncoder()
        .encodeToString(
            cert.getEncoded())
    + "\n-----END CERTIFICATE-----";

Java 25 (Preview)

// Encode to PEM
String pem = PEMEncoder.of()
    .encodeToString(cert);
// Decode from PEM
var cert = PEMDecoder.of()
    .decode(pemString);

Hover to see modern ➜

JDK 25+ →

Security Advanced

Key Derivation Functions

Java 8

SecretKeyFactory factory =
    SecretKeyFactory.getInstance(
        "PBKDF2WithHmacSHA256");
KeySpec spec = new PBEKeySpec(
    password, salt, 10000, 256);
SecretKey key =
    factory.generateSecret(spec);

Java 25

var kdf = KDF.getInstance("HKDF-SHA256");
SecretKey key = kdf.deriveKey(
    "AES",
    KDF.HKDFParameterSpec
        .ofExtract()
        .addIKM(inputKey)
        .addSalt(salt)
        .thenExpand(info, 32)
        .build()
);

Hover to see modern ➜

JDK 25+ →

Security Beginner

Strong random generation

Java 8

// Default algorithm — may not be
// the strongest available
SecureRandom random =
    new SecureRandom();
byte[] bytes = new byte[32];
random.nextBytes(bytes);

Java 9+

// Platform's strongest algorithm
SecureRandom random =
    SecureRandom.getInstanceStrong();
byte[] bytes = new byte[32];
random.nextBytes(bytes);

Hover to see modern ➜

JDK 9+ →