title: Getting a "No appropriate protocol error" when trying to launch my app
body: <p>I've had a Spring Boot web application running successfully in both a Staging and Production environment with an nginx proxy with SSL certificates for a few months now.  All of sudden, last night I started seeing errors in the Production server when trying to connect to a mail server when the app tries to send mail messages.  In trying to debug, I'm now completely unable to even start up the app in our Staging environment.  This is the original error I was seeing in Production, seeing some variation of this error in Staging as well now:</p>
  <pre><code>2021-05-01 15:00:50,435 ERROR [o.a.c.c.C.[.[.[.[dispatcherServlet]] (http-nio-8088-exec-4) Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is org.springframework.mail.MailSendException: Mail server connection failed; nested exception is javax.mail.MessagingException: Can't send command to SMTP host;
    nested exception is:
          javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate). Failed messages: javax.mail.MessagingException: Can't send command to SMTP host;
    nested exception is:
          javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate); message exceptions (1) are:
  Failed message 1: javax.mail.MessagingException: Can't send command to SMTP host;
    nested exception is:
          javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)] with root cause
  javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate)
          at sun.security.ssl.HandshakeContext.&lt;init&gt;(HandshakeContext.java:171)
          at sun.security.ssl.ClientHandshakeContext.&lt;init&gt;(ClientHandshakeContext.java:98)
          at sun.security.ssl.TransportContext.kickstart(TransportContext.java:220)
          at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:428)
          at sun.security.ssl.SSLSocketImpl.ensureNegotiated(SSLSocketImpl.java:804)
          at sun.security.ssl.SSLSocketImpl.access$200(SSLSocketImpl.java:73)
          at sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:1166)
          at com.sun.mail.util.TraceOutputStream.write(TraceOutputStream.java:101)
          at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
          at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
          at com.sun.mail.smtp.SMTPTransport.sendCommand(SMTPTransport.java:1418)
          at com.sun.mail.smtp.SMTPTransport.sendCommand(SMTPTransport.java:1408)
  </code></pre>
  <p>The error points to some problem with my SSL protocols or ciphers, but I have no idea what could be wrong.  My nginx config hasn't changed, so something must have changed in what's allowed/secure now.  Here are the relevant parts of my config:</p>
  <pre><code>  ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers &quot;ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS&quot;;
  </code></pre>
  <p>I've tried modifying the ciphers list to remove parts of it, but nothing succeeds.  This is not an area I understand very well and have relied on some others to get things set up, but I'm guessing that something in this configuration expired or became outdated right as the month rolled from April to May (errors started right after midnight last night GMT).  Any help or suggestions greatly appreciated!</p>