ZOOKEEPER-5045: Fall back to TLSv1.2 default in FIPS mode

[PDavid]

Reviewers: meszibalu
Author: PDavid
Closes #2380 from PDavid/ZOOKEEPER-5045

(cherry picked from commit d4e15d3)

[PDavid]

This is the backport of #2380 to branch-3.9. Cherry-picked the d4e15d3 commit but it did not applied cleanly. Had to resolve a small conflict in X509Util. Also had to fix ClientX509Util a bit.

[PDavid]

Some tests in SSLHostnameVerificationTest failed. I'll have a look.

[PDavid]

FYI: We miss this patch on this (3.9) branch: https://issues.apache.org/jira/browse/ZOOKEEPER-4912

To be honest I'm not sure if we need that patch in 3.9 or not. Just it is related.

For fixing SSLHostnameVerificationTest I now patched ClientX509Util.getEnabledProtocols the same way:

9aae22e

[anmolnar]

Thanks @PDavid for the contribution.
What if we backport ZOOKEEPER-4912 first?
Sounds like something that we should consider, because according to the Jira ticket it fixes problems in 3.9 too.

[PDavid]

Thanks @PDavid for the contribution. What if we backport ZOOKEEPER-4912 first? Sounds like something that we should consider, because according to the Jira ticket it fixes problems in 3.9 too.

Thanks, sure, makes sense. Here it is:
#2386