Description

This article explains TLS 1.3 support on Junos Space.



Symptoms

In TLS1.3, the connection fails with various reasons. Like: protocol version not supported , certificate was not present etc..
TLSv1.2 is supported as per below output and also connection with the server is getting established.

cat /etc/httpd/conf.d/webProxy.conf | grep -i TLSv -A1
    #SSLProtocol -ALL +TLSv1
    #SSLCipherSuite ECDHE-RSA-AES256-SHA384:AES256-SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM
--
    SSLProtocol -ALL +TLSv1.2
    SSLCipherSuite TLSv1.2:!aNULL:!eNULL:!MD5:!RC4:!SHA1:!EXPORT:!RSA:!DSS:!kECDH

>With TLSv1.2

openssl s_client -connect 10.157.41.151:443 -tls1_2
CONNECTED(00000003)
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES256-GCM-SHA384
    Session-ID: EBF3106335A78255EA7539D598F6FEC04768B07F31FB72412287242FAC51498C
    Session-ID-ctx:
    Master-Key: F8C0F01B0A055EB28DCA45F14E79B3632443CC3C44A19E625C644AFCDA9E46C17D540EB39E0E124B1885584D99AF4B52
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    TLS session ticket lifetime hint: 300 (seconds)
    TLS session ticket:

>With TLSv1.3
openssl s_client -connect 10.157.41.151:443 -tls1_3
CONNECTED(00000003)
4007B3F2B87F0000:error:0A00042E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:../ssl/record/rec_layer_s3.c:1593:SSL alert number 70
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 7 bytes and written 225 bytes
Verification: OK
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)

 

Solution

Junos Space/Security Director doesn't support TLS 1.3. We have the support for SD on-prem

Modification History

2025-07-29 : Article Created