Force protocol in Client using httpClient 4.3.6 on Java 6

Question

For some testing reason I need to force SSLv3 to be used by Client. SSLv3 is an accepted protocol in server. Tried to force by using SSLContextBuilder.useProtocol("SSLv3") as below:

SSLContextBuilder initiated as below:

    SSLContextBuilder builder = SSLContexts.custom();

    SSLContext sslContext = builder.useProtocol("SSLv3").build();

    SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new X509HostnameVerifier() {
        @Override
        public void verify(String host, SSLSocket ssl) throws IOException {
        }
     ....
     ....);
    return sslsf;
}

But the result in log shows handshaking always do in TLSv1:

....
....
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
%% No cached client session
*** ClientHello, TLSv1
RandomCookie:  
GMT: 1503650935 
bytes = { 
255, 
....
....

My understanding, client should request for the protocol that is defined whether server accept or not. In this case, I expect to see client should request to use SSLv3 not TLSv1.

Does it really have to be HC 4.3 and not a newer version?

ok2c
– ok2c

2018-03-08 08:57:53 +00:00
Commented Mar 8, 2018 at 8:57 — ok2c
– ok2c, Commented Mar 8, 2018 at 8:57
Yes, I have to use HC 4.3.6.

Kambiz
– Kambiz

2018-03-08 10:30:13 +00:00
Commented Mar 8, 2018 at 10:30 — Kambiz
– Kambiz, Commented Mar 8, 2018 at 10:30

ok2c · Accepted Answer · 2018-03-08 10:41:36Z

1

That will force HC 4.3 to use SSLv3 only

SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
        SSLContext.getDefault(), new String[] {"SSLv3"}, null, SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER);
CloseableHttpClient httpClient = HttpClients.custom()
        .setSSLSocketFactory(sslSocketFactory)
        .build();

answered Mar 8, 2018 at 10:41

ok2c

27.9k5 gold badges66 silver badges74 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Kambiz Over a year ago

......*** ClientHello, SSLv3 ......RandomCookie: GMT: 1503744762 It works Thanks

Collectives™ on Stack Overflow

Force protocol in Client using httpClient 4.3.6 on Java 6

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related