Fix SSL handshake failure by supporting modern TLS versions

[Copilot]

Problem

The WxJava SDK was experiencing intermittent javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure exceptions when enterprise WeChat applications called official WeChat APIs. This occurred because the HTTP client was hardcoded to only use TLS 1.0, which modern servers (including WeChat's APIs) have disabled due to security vulnerabilities.

Before:

return new SSLConnectionSocketFactory(
  sslcontext,
  new String[]{"TLSv1"},  // Only TLS 1.0 - PROBLEM!
  null,
  SSLConnectionSocketFactory.getDefaultHostnameVerifier());

Solution

Updated the DefaultApacheHttpClientBuilder to support modern TLS versions while maintaining backward compatibility:

After:

private String[] supportedProtocols = {"TLSv1.2", "TLSv1.3", "TLSv1.1", "TLSv1"};

return new SSLConnectionSocketFactory(
  sslcontext,
  this.supportedProtocols,  // Modern TLS versions!
  null,
  SSLConnectionSocketFactory.getDefaultHostnameVerifier());

Changes Made

1. Updated default TLS protocols: Changed from TLS 1.0 only to support TLS 1.2, 1.3, 1.1, and 1.0
2. Made TLS protocols configurable: Added supportedProtocols(String[]) method to allow custom TLS configuration
3. Enhanced interface: Updated ApacheHttpClientBuilder interface with new method
4. Comprehensive testing: Added SSLConfigurationTest and SSLIntegrationTest to verify the fix

Test Results

Default supported TLS protocols: [TLSv1.2, TLSv1.3]
JVM supported TLS protocols: [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
Tests run: 4, Failures: 0, Errors: 0, Skipped: 0

Impact

• ✅ Resolves intermittent SSL handshake failures with WeChat APIs
• ✅ Enterprise WeChat applications will now use secure, modern TLS versions
• ✅ Maintains backward compatibility for existing deployments
• ✅ Provides configurability for custom TLS requirements

Usage

// Default configuration now supports modern TLS
DefaultApacheHttpClientBuilder builder = DefaultApacheHttpClientBuilder.get();
CloseableHttpClient client = builder.build(); // Uses TLS 1.2/1.3

// Or customize TLS protocols
builder.supportedProtocols(new String[]{"TLSv1.2", "TLSv1.3"});

Fixes #3621.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.