How Do I Specify a Negotiated Cipher Suite for ClickHouse 0.65?

[perfectyc2201]

Use case

Describe the solution you'd like

Describe the alternatives you've considered

Additional context

[chernser]

/triage

[github-actions]

Triage Report

Effort to Fix: Small
Type: Question / Feature Request
Affected Module: client-api-v2 (also relevant to client-v1 / jdbc-v1 / jdbc-v2)

Summary

The user is asking how to configure a specific TLS cipher suite when using the clickhouse-java driver (likely v0.65). No cipher suite selection property exists in the current SSL configuration API (ClientConfigProperties in client-v2, or ClickHouseClientOption in client-v1); the driver exposes trust store, key store, CA cert, client cert, and SNI options but nothing for cipher suite restriction.

Recommended Labels & Priority

• Labels: question, client-api-v2, area:network, area:docs

Missing Information / Questions for User

1. Which driver artifact and version are you using — clickhouse-java (client-v2 / jdbc-v2) or the legacy clickhouse-jdbc (v1)? "0.65" looks like a driver version — please confirm the Maven artifact ID.
2. Are you connecting via plain Java client (com.clickhouse.client.api.Client) or via the JDBC driver (java.sql.DriverManager / DataSource)?
3. What is the specific cipher suite you need to negotiate, and why is the default negotiated suite not acceptable (e.g., server enforces a restricted list, compliance requirement)?
4. What is the ClickHouse server version and its openSSL / cipherList server-side configuration?
5. Have you tried providing a custom SSLContext through the client builder, or configuring JVM-level cipher suite restrictions via jdk.tls.client.cipherSuites?

Tests to Add

Test 1: Client-v2 — connect with a restricted cipher suite list via custom SSLContext

// Once a cipher-suite config property is added, verify TLS handshake succeeds
// when the client cipher list overlaps with the server's allowed list.
SSLContext ctx = SSLContext.getInstance("TLS");
// ... init ctx with desired ciphers via SSLParameters
Client client = new Client.Builder()
    .addEndpoint("https://localhost:8443")
    .setOption(ClientConfigProperties.SSL_CIPHER_SUITES.getKey(), "TLS_AES_256_GCM_SHA384")
    .build();
try (QueryResponse resp = client.query("SELECT 1").get()) {
    // assert result
}

Test 2: JDBC v2 — cipher suite in connection URL / properties

// Verify that specifying ssl_cipher_suites in the JDBC URL routes the cipher
// preference through to the underlying SSLSocket/SSLEngine.
Properties props = new Properties();
props.setProperty("ssl", "true");
props.setProperty("sslrootcert", "/path/to/ca.crt");
props.setProperty("ssl_cipher_suites", "TLS_AES_256_GCM_SHA384");
try (Connection conn = DriverManager.getConnection(
        "jdbc:clickhouse://localhost:8443/default", props)) {
    // assert connection succeeds and negotiated cipher matches expectation
}

[perfectyc2201]

1、the legacy clickhouse-jdbc (v1)
2、connect via the JDBC driver (java.sql.DriverManager / DataSource
3、the default negotiated suites contains not safety suites

[chernser]

@perfectyc2201
Thank you for reporting the issue!
Will fix it shortly.

[perfectyc2201]

We used clickhouse-jdbc-0.6.5.jar and tried to modify the JVM parameter by setting -Dhttps.socketCipherSuites=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384. However, the setting did not take effect. We also tried to add ssl_context to the JDBC URL, but it also did not take effect. ClickHouse JDBC 0.6.5 supports only the following SSL parameters:
ssl=true: enables SSL.
ssl_mode=STRICT: enables SSL and does not verify the certificate. This is used for testing.
ssl_mode=VERIFY_CA: verifies the server certificate.
ssl_mode=VERIFY_IDENTITY: verifies the server certificate and domain name.
The official connection parameter that does not pass the custom SSLContext is not transferred.

[chernser]

@perfectyc2201
I'm looking into the code of V1 and do not see it supports different ssl modes.
In next release we plan to add some #2874
So your issue is at good time

[perfectyc2201]

First of all, thank you very much for your response.

1. I am very sorry that I did not answer one question accurately. We are using clickhouse-jdbc 0.6.5, and I am not sure whether it belongs to V1 or V2. I hope you can provide an answer after seeing this. Thank you very much.
2. Does version 0.6.5 support configuring cipher suites? We have successfully added the parameter -Djdk.tls.client.cipherSuites to the JVM, but I want to precisely control the cipher suites for ClickHouse. How can I do this?

[chernser]

@perfectyc2201
This is fine! no worries - your request understandable enough.
neither client has cipher configuration what is crucial things to miss. We will add this in one of nearest releases.

[perfectyc2201]

Thank you very much for your answer.