enable TLSv1.3 by default

manifests/init.pp

@@ -209,7 +209,7 @@
   Stdlib::Absolutepath $ca_cert = '/etc/candlepin/certs/candlepin-ca.crt',
   Optional[Variant[Sensitive[String], String]] $ca_key_password = undef,
   Array[String] $ciphers = $candlepin::params::ciphers,
-  Array[String] $tls_versions = ['1.2'],
+  Array[String] $tls_versions = ['1.2', '1.3'],
   Optional[String[1]] $java_package = undef,
   String $version = 'present',
   Optional[String] $adapter_module = undef,

spec/acceptance/basic_candlepin_spec.rb

@@ -6,27 +6,26 @@
   include_examples 'the example', 'basic_candlepin.pp'
 
   describe port(8443) do
     it { is_expected.to be_listening }
   end
 
   describe command('curl -k -s -o /dev/null -w \'%{http_code}\' https://localhost:8443/candlepin/status') do
     its(:stdout) { should eq "200" }
   end
 
   describe command('nmap --script +ssl-enum-ciphers localhost -p 8443') do
-    # We don't enable TLSv1.3 by default yet. TLSv1.3 support was added in tomcat 7.0.92
-    # But tomcat 7.0.76 is the latest version available on EL7
-    its(:stdout) { should_not match(/TLSv1\.3/) }
-
     # Test that TLSv1.2 is enabled
     its(:stdout) { should match(/TLSv1\.2/) }
 
+    # Test that TLSv1.3 is enabled
+    its(:stdout) { should match(/TLSv1\.3/) }
+
     # Test that older TLS versions are disabled
     its(:stdout) { should_not match(/TLSv1\.1/) }
     its(:stdout) { should_not match(/TLSv1\.0/) }
 
     # Test that the least cipher strength is "strong" or "A"
     its(:stdout) { should match(/least strength: (A|strong)/) }
   end
 
   describe file("/etc/tomcat/cert-users.properties") do

spec/classes/candlepin_spec.rb

@@ -313,14 +313,14 @@
 
       describe 'with tls_versions' do
         let :params do
-          {tls_versions: ['1.2', '1.3']}
+          {tls_versions: ['1.3']}
         end
 
         it { is_expected.to compile.with_all_deps }
         it do
           is_expected.to contain_file("/etc/tomcat/server.xml").
-            with_content(/sslProtocol="TLSv1.2,TLSv1.3"/).
-            with_content(/sslEnabledProtocols="TLSv1.2,TLSv1.3"/)
+            with_content(/sslProtocol="TLSv1.3"/).
+            with_content(/sslEnabledProtocols="TLSv1.3"/)
         end
       end