All requests to https://careers.virtusa.com are redirected to a McAfee Web Gateway (a proxy)
Request URL:https://careers.virtusa.com/
Request Method:GET
Status Code:302 Found
Remote Address:203.62.173.60:443
If you do a simply request to that address http://203.62.173.60:443 you will get a handshake error
Handshake failed
The SSL handshake could not be performed.
Host: 10.4.190.60
Reason: :state 21:Application response 500 handshakefailed
because the gateway are expecting a secure HTTP request from a trusted client, with the careers.virtusa.com certificate.
The problem does not appear within the Web Browser because I suppose that the front Web server of virtusa internaly redirects to the Web Gateway using the trusted certificate so finally returns the webpage without problems.
In the other hand, most of modern web browsers uses TLS 1.1 or TLS 1.2 by default to do the secure requests, but Java dont, depends on the Java version.
If you analyze careers.virtusa.com you will see that only supports 1.1 and 1.2
TLS 1.2 Yes
TLS 1.1 Yes
TLS 1.0 No
SSL 3 No
SSL 2 No
JDK 5 and 6 supports SSLv3 and TLSv1 so if you use that version you will get a SSL exception.
JDK 7, 8 and 9 supports SSLv3, TLSv1, TLSv1.1 and TLSv1.2 but you need explicitly indicate the supported protocols for your connection, in this case
new String[] { "TLSv1.1", "TLSv1.2" }
So, you need:
- The certificate with the public key of
careers.virtusa.com (using openssl s_client or from the browser directly)
- Import a certificate into a keystore to use it as truststore with your HTTP client connection.
- Java version > 6.
- Set the supported protocols for the connection.
An example (with Apache HttpComponents 4.4.1)
import java.io.File;
import javax.net.ssl.SSLContext;
import org.apache.commons.io.IOUtils;
import org.apache.http.HttpEntity;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.HttpGet;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClients;
import org.apache.http.ssl.SSLContexts;
import org.apache.http.util.EntityUtils;
public class SSLTest {
public final static void main(String[] args) throws Exception {
SSLContext sslcontext = SSLContexts.custom()
.loadTrustMaterial(new File("/tmp/careers.virtusa.com.jks"), "changeit".toCharArray(), new TrustSelfSignedStrategy()).build();
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslcontext, new String[] { "TLSv1.1", "TLSv1.2" }, null,
SSLConnectionSocketFactory.getDefaultHostnameVerifier());
CloseableHttpClient httpClient = HttpClients.custom().setSSLSocketFactory(sslsf).build();
try {
HttpGet httpget = new HttpGet("https://careers.virtusa.com/");
CloseableHttpResponse response = httpClient.execute(httpget);
try {
HttpEntity entity = response.getEntity();
if (entity != null) {
System.out.println("Response content length: " + entity.getContentLength());
System.out.println(IOUtils.toString(entity.getContent()));
}
EntityUtils.consume(entity);
} finally {
response.close();
}
} finally {
httpClient.close();
}
}
}
Then you can get the web page contents using both urls, http://careers.virtusa.com/ or https://careers.virtusa.com/
Hope this helps.
