private static String[] getOpenSslFilteredDefaultCiphers() {
    if (!OpenSsl.isAvailable()) {
      return new String[0];
    }

    Set<String> openSslSuites = OpenSsl.availableJavaCipherSuites();
    List<String> defaultSuites = new ArrayList<>();
    Arrays.stream(getTls13Ciphers()).filter(openSslSuites::contains).forEach(defaultSuites::add);
    Arrays.stream(getGCMCiphers()).filter(openSslSuites::contains).forEach(defaultSuites::add);
    Arrays.stream(getCBCCiphers()).filter(openSslSuites::contains).forEach(defaultSuites::add);
    return defaultSuites.toArray(new String[0]);
  }
Not all of our default ciphers are available in OpenSSL. Takes our default cipher lists and
filters them to only those available in OpenSsl. Prefers TLS 1.3, then GCM, then CBC because
GCM tends to be better and faster, and we don't need to worry about the java8 vs 9 performance
issue if OpenSSL is handling it.
hbase-common/src/main/java/org/apache/hadoop/hbase/io/crypto/tls/X509Util.java