4

I'm trying to call a REST API for some end point URL, it was running fine for the URL of java.net and after executing the same. But on some machines it failed for some SSLException so the code was modified like this:

HttpsURLConnection connection = (HttpsURLConnection) new URL( url ).openConnection()

SSLContext sc = SSLContext.getInstance("TLSv1.2")
sc.init(null, null, new SecureRandom())
connection.setSSLSocketFactory(sc.getSocketFactory())
connection.setRequestProperty("charset", "utf-8")

InputStream input = connection.getInputStream()
InputStreamReader reader = new InputStreamReader(input, "utf-8")
BufferedReader buffer = new BufferedReader(reader)

buffer.lines().collect(Collectors.joining("\n"))

Now again it's working fine, if I'm not wrong it is for secured communication, but then why was the SSLexception on Linux env and not on Windows, and SSLContext.getInstance("TLSv1.2") will this work on all environments, why not TLSV1.1 does all environment have 1.2 or latest version by default, how do I make sure that it will run on all the environments?

tyro
  • 765
  • 2
  • 13
  • 34

1 Answers1

6

TLS stands for Transport Layer Security which is the standard superseding Secure Sockets Layer (SSL). There are few versions of TLS out of which v1.1 and v1.2 are consider secure (at the moment v1.3 is being drafted). If you don't want to dive into technical details using the latest available TLS version is the best idea.

TLSv1.2 in Java is nicely explained here: JDK 8 will use TLS 1.2 as default. Since TLSv1.2 is implemented inside the JDK it should work on all operating systems. Since there are multiple JDK vendors (Oracle, OpenJDK, Azul, etc.) you want to test this with your JDK. The gotcha is that older version e.g. Oracle HotSpot Java 6 support only SSL and you won't get TLS unless you have premium Oracle maintenance release or custom libraries.

Sadeq Dousti
  • 3,346
  • 6
  • 35
  • 53
Karol Dowbecki
  • 43,645
  • 9
  • 78
  • 111
  • very well explained Thanks Karol :) – tyro Mar 14 '18 at 10:48
  • 1
    The free versions of j6 do support TLSv1.0 (rfc2246) under the name `TLSv1` (i.e. without .0) but 1.0 is subject to the predictable-IV attack popularized by BEAST in 2011 and now often used (e.g. PCI) as reason to prohibit 1.0 even though it was actually well-mitigated quite quickly (including 6u29 up) by record splitting. – dave_thompson_085 Mar 15 '18 at 07:25