Description of problem:

[RFE]: TLS 1.3 Support for Candlepin in Satellite 6

Version-Release number of selected component (if applicable):
satellite-6.14.0-3.el8sat.noarch
candlepin-4.3.1-1.el8sat.noarch

How reproducible:
New installation

Steps to Reproduce:

1. Install the latest version of satellite 6 on RHEL 8
2. Test the connection through openssl/Curl/nmap

Actual results:

1. nmap --script +ssl-enum-ciphers localhost -p 23443

PORT STATE SERVICE
23443/tcp open unknown

Nmap done: 1 IP address (1 host up) scanned in 0.50 seconds

1. curl --tlsv1.3 -v https://localhost:23443/candlepin --cacert /etc/pki/katello/certs/katello-default-ca.crt

• Trying ::1...
• TCP_NODELAY set
• connect to ::1 port 23443 failed: Connection refused
• Trying 127.0.0.1...
• TCP_NODELAY set
• Connected to localhost (127.0.0.1) port 23443 (#0)
• ALPN, offering h2
• ALPN, offering http/1.1
• successfully set certificate verify locations:
• CAfile: /etc/pki/katello/certs/katello-default-ca.crt
  CApath: none
• TLSv1.3 (OUT), TLS handshake, Client hello (1):
• TLSv1.3 (IN), TLS alert, protocol version (582):
• error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version
• Closing connection 0
  curl: (35) error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version

[root@vm255-136 ~]# openssl s_client -connect localhost:23443 -tls1_3 -CAfile /etc/pki/katello/certs/katello-default-ca.crt
CONNECTED(00000003)
139807602083648:error:1409442E:SSL routines:ssl3_read_bytes:tlsv1 alert protocol version:ssl/record/rec_layer_s3.c:1544:SSL alert number 70
—
no peer certificate available
—
No client certificate CA names sent
—
SSL handshake has read 7 bytes and written 240 bytes
Verification: OK
—
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
Early data was not sent
Verify return code: 0 (ok)
—

Expected results:

Additional info:

The expectation for the Request for Enhancement (RFE) to add TLS 1.3 support in candlepin
TLS 1.3 is the latest version of the TLS protocol and offers enhanced security and performance benefits over earlier versions. The expectation is that supporting TLS 1.3 will improve the overall security posture of Foreman Proxy and Satellite 6.

1. /usr/sbin/tomcat version
   Server version: Apache Tomcat/9.0.50
   Server built: Jun 24 2022 20:49:41 UTC
   Server number: 9.0.50.0
   OS Name: Linux
   OS Version: 4.18.0-240.el8.x86_64
   Architecture: amd64
   JVM Version: 17.0.8+7-LTS
   JVM Vendor: Red Hat, Inc.