https://foojayio.github.io/website/today/author/joe-kuhel/Articles written by Joe Kuhel on foojay.io - Friends of OpenJDKHugoen-usThu, 26 Feb 2026 18:02:34 +0000https://foojayio.github.io/website/today/tomcat-tlsv13-cipher-configuration-spring-boot/Thu, 26 Feb 2026 18:02:34 +0000https://foojayio.github.io/website/today/tomcat-tlsv13-cipher-configuration-spring-boot/<p>A recent update to Apache Tomcat introduced a subtle but significant change to how TLS cipher suites are configured. If your Spring Boot application explicitly configures TLS ciphers, particularly TLSv1.3 ciphers, and runs on Tomcat 9.0.115+ (Spring Boot 2.x), 10.1.52+ (Spring Boot 3.x), or 11.0.18+ (Spring Boot 4.x), your cipher configuration may be silently ignored.</p> <p>Prior to the change, Tomcat used a single <code>ciphers</code> attribute on the SSL connector to configure cipher suites for all TLS versions. Starting with the versions of Tomcat listed above (Tomcat <a href="https://github.com/apache/tomcat/commit/9abf6bddb2e84ecf1668780bb3150b799f832ccf" target="_blank" rel="noopener noreferrer">commit</a> ), this attribute was split:</p>