title: SSLContext.getInstance("TLS") vulnerability
body: <p>We get the call <code>SSLContext.getInstance(&quot;TLS&quot;)</code> reported as vulnerability. The recommended fix is to use <code>SSLContext.getInstance(&quot;TLSv1.2&quot;)</code>.</p>
  <p>I learnt that TLSv1.1 and TLSv1 are disabled anyway since April 2021 in Java implementations, but when I experimented with this fix, I found out that this will disable TLSv1.3 (even if I add it via <code>sslSocket.setEnabledProtocols(protocols)</code>).</p>
  <p>When I use <code>SSLContext.getInstance(&quot;TLSv1.3&quot;)</code>, <code>sslSocket.getEnabledProtocols()</code> returns both TLSv1.3 and TLSv1.2 and if the server side only supports TLSv1.2, a connection is established.</p>
  <p>This is unexpected to me. For me, this would be an &quot;algorithm downgrade&quot;.</p>
  <p>Documentation says only &quot;may support other SSL/TLS versions&quot;, so when I specify &quot;TLSv1.3&quot;, I cannot expect that fallback to &quot;TLSv1.2&quot; works, right?</p>
  <p>Although it looks like the <code>SSLContext.getInstance</code> parameter is the highest supported TLS version.</p>
  <p>So what is the right way to implement an SSL connection were the server side may support either TLSv1.2 or TSLv1.3 or both (and don't get a vulnerability reported)?</p>
  <p>Regards,
  Andreas</p>