With reference to the POODLE vulnerability, i need to force my code to use ONLY TLSv1 and NOT SSLv3. I have set the sslProtocols="TLSv1" in my server.xml file, and set the system property "https.protocols" to "TLSv1". Though this works with the connections created using HttpsUrlConnection, this doesnt solve the connections created using org.apache.commons.httpclient.HttpClient
Java version is 1.5+
My Sample code is as follows
Connection initiation
MultiThreadedHttpConnectionManager httpConnectionManager = new MultiThreadedHttpConnectionManager();
connParams = httpConnectionManager.getParams();
connParams.setDefaultMaxConnectionsPerHost(10);
connParams.setMaxTotalConnections(75);
connParams.setConnectionTimeout(1000);
connParams.setSoTimeout(30000);
httpConnectionManager.setParams(connParams);
clientParams = new HttpClientParams();
clientParams.setParameter(HttpMethodParams.RETRY_HANDLER, new DefaultHttpMethodRetryHandler(0, true));
try{
Protocol customHttps = new Protocol("https", new EasySSLProtocolSocketFactory(), 443);
Protocol.registerProtocol("https",customHttps); //No I18N
}
catch(Exception ex)
{
ex.printStackTrace();
}
httpClient = new org.apache.commons.httpclient.HttpClient(clientParams, httpConnectionManager);
URL Calling
HttpMethod method = new GetMethod(url);
client.executeMethod(method);
Properties serviceData = new Properties();
serviceData.load(method.getResponseBodyAsStream());
Error received
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1720)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:954)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:632)
Any help to solve this is highly appreciated.
Thanks in advance.
--N.Shankar