@Test
    @EnabledForJreRange(min = JRE.JAVA_11)
    public void testCiphersSuiteFailForServerTls12ClientTls13() throws Exception {
        String tls12CipherSuite = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
        String tls13CipherSuite = "TLS_AES_128_GCM_SHA256";

        sslServerConfigs.put(SslConfigs.SSL_PROTOCOL_CONFIG, "TLSv1.2");
        sslServerConfigs.put(SslConfigs.SSL_ENABLED_PROTOCOLS_CONFIG, Collections.singletonList("TLSv1.2"));
        sslServerConfigs.put(SslConfigs.SSL_CIPHER_SUITES_CONFIG, Collections.singletonList(tls12CipherSuite));
        server = NetworkTestUtils.createEchoServer(ListenerName.forSecurityProtocol(SecurityProtocol.SSL),
            SecurityProtocol.SSL, new TestSecurityConfig(sslServerConfigs), null, TIME);

        sslClientConfigs.put(SslConfigs.SSL_PROTOCOL_CONFIG, "TLSv1.3");
        sslClientConfigs.put(SslConfigs.SSL_CIPHER_SUITES_CONFIG, Collections.singletonList(tls13CipherSuite));

        checkAuthenticationFailed();
    }
Tests that connections can't be made if server uses TLSv1.2 with custom cipher suite and client uses TLSv1.3.
clients/src/test/java/org/apache/kafka/common/network/SslTransportTls12Tls13Test.java