0

We run a legacy application that uses Java 6. Recently, our partners notified us that they are going to drop support of TLS versions older than TLS 1.1. This means that after the upgrade our outbound HTTPS connections to these partners will stop working.

The application is big and upgrade to newer version of JDK is something that we cannot afford now.

We tried to use the latest non-public release of Java 6 that we downloaded from restricted section of Oracle site (jdk-6u113). Although release notes for this release of Java 6 say that TLS1.1 is available, it is not enabled out of the box, there is nothing in there saying about how to enable it via changes in configuration, and an attempt to establish a connection to the endpoint which does not support pre-TLS1.1 results in SSLHandshakeException

Now I am trying to enable TLS1.1. So far I have tried a couple different options:

  • Adding a property deployment.security.TLSv1.1=true to deployment.properties file in .java folder for the user who runs java

  • Including -Ddeployment.security.TLSv1.1=true system property to the java command line.

Neither option seem to work; it appears that deployment.security.TLSv1.1 property is only used by never version of Java.

Please can someone let me know how we should enable TLS1.1 by means of changing the configuration ?

Also need to say that the application in question is quite big, and making change in the code in order to enable TLS 1.1 is something we would like to avoid.

Mike Degteariov
  • 69
  • 6
  • Even if the app is written in Java 6, you should be able to run it with JRE 8 (at least in theory). Have you tried that? – Mick Mnemonic Mar 24 '16 at 17:57
  • The application is big, runs on Jboss 5 and uses a number of old components that we know will not be compatible with Java 8. We are not considering the upgrade of JDK – Mike Degteariov Mar 24 '16 at 18:03
  • One option might be to use a different JCE provider such as [Bouncy Castle](http://stackoverflow.com/questions/18065170/how-do-i-do-tls-with-bouncycastle) together with JDK 6. – Mick Mnemonic Mar 24 '16 at 18:19
  • I know about the BounceCastle option; this is what I am going to try after I run out of ideas on how to enable TLS1.1 through configuration. – Mike Degteariov Mar 24 '16 at 18:22

0 Answers0