1

With reference to the POODLE vulnerability, i need to force my code to use ONLY TLSv1 and NOT SSLv3. I have set the sslProtocols="TLSv1" in my server.xml file, and set the system property "https.protocols" to "TLSv1". Though this works with the connections created using HttpsUrlConnection, this doesnt solve the connections created using org.apache.commons.httpclient.HttpClient

Java version is 1.5+

My Sample code is as follows

Connection initiation

MultiThreadedHttpConnectionManager httpConnectionManager = new MultiThreadedHttpConnectionManager();
connParams = httpConnectionManager.getParams();
connParams.setDefaultMaxConnectionsPerHost(10);
connParams.setMaxTotalConnections(75);
connParams.setConnectionTimeout(1000);
connParams.setSoTimeout(30000);
httpConnectionManager.setParams(connParams);
clientParams = new HttpClientParams();
clientParams.setParameter(HttpMethodParams.RETRY_HANDLER, new DefaultHttpMethodRetryHandler(0, true));

try{
    Protocol customHttps = new Protocol("https", new EasySSLProtocolSocketFactory(), 443); 
    Protocol.registerProtocol("https",customHttps); //No I18N
}
catch(Exception ex)
{
    ex.printStackTrace();
}

httpClient = new org.apache.commons.httpclient.HttpClient(clientParams, httpConnectionManager);

URL Calling

HttpMethod method = new GetMethod(url);
client.executeMethod(method);
Properties serviceData = new Properties();
serviceData.load(method.getResponseBodyAsStream());

Error received

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1720)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:954)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:632)

Any help to solve this is highly appreciated.

Thanks in advance.

--N.Shankar

0 Answers0