Consider upgrading the mail utilites from Java Mail to Jakarta Mail

[jjg-123]

The last version of Java Mail is 1.6.2 and dates from 2017 or so. This was when Sun still managed it. It was open sourced and became Jakarta Mail. We should consider switching to that since there have been many improvements since, but at this point, it is not critical, merely nice to have.

[jjg-123]

This may be more critical than I thought. Testing has shown that start TLS fails consistently with

"javax.net.ssl.SSLException: Unsupported or unrecognized SSL message"

and the likely culprit is the fact that Java Mail 1.6.2 (Aug. 2018) is too ancient and does not support a recent enough version of TLS. TLS 1.2 was released in 2008 and was replaced by 1.3 in 2018 (in Java 11, released Sept. 2018). It seems that since Java Mail supports 1.2 which is now widely refused due to various vulnerabilities, it is losgin the ability to work with more recent software.

The main issue is that all the classes have been renamed, so that there is no graceful upgrade for users such as CIlogon -- they have to upgrade their server lib directory to take advantage of this change.

(However CILogon uses plain SMTP on its mail server that runs on localhost only, so this does not affect CILogon at all.)

[jjg-123]

Final thoughts. Jakarta Mail is part of Jakarta EE which is the successor to Java EE. The mail facilities do not interoperate with old Java mail (they both use introspection to load classes which causes massive class cast exceptions since there are mutliple class loaders and this really can't be fixed without the equivalent of brain surgery). On top of that, the correct Jakarta jar has to be supplied and that is bundled with Jakarta EE, so not easy to find and not supported as a stand-alone dependency.

Fortunately, there is a versioned successor to Java Mai 1.6.2 (last release from Sun). Jakarta mail released an updated version, 1.6.7 in 2000 which does support TLS 1.3, so we can upgrade to that instead of porting everything to Jakarta mail.