javasslhttpsurlconnection

Java HttpsURLConnection and TLS 1.2

I read in an article that HttpsURLConnection will transparently negotiate the SSL connection.

The official document says:

This class uses HostnameVerifier and SSLSocketFactory. There are default implementations defined for both classes. [1]

Does that mean once you open a connection with

httpsCon = (HttpsURLConnection) url.openConnection();

It is already SSL/TLS encrypted without any more hassle?

How can I view and set the TLS version for the standard implementation? (Should be TLS 1.2 for Java 8 and TLS 1.0 for Java 7)

References

  1. Oracle Corp. (2011). javax.net.ssl.HttpsURLConnection. (JavaDoc)
Solution

  • You will have to create an SSLContext to set the Protocoll:

    in Java 1.8:

     SSLContext sc = SSLContext.getInstance("TLSv1.2");
 // Init the SSLContext with a TrustManager[] and SecureRandom()
 sc.init(null, trustCerts, new java.security.SecureRandom());

    in Java 1.7:

     SSLContext sc = SSLContext.getInstance("TLSv1");
 // Init the SSLContext with a TrustManager[] and SecureRandom()
 sc.init(null, trustCerts, new java.security.SecureRandom());

    then you just have to set the SSLContext to the HttpsURLConnection:

    httpsCon.setSSLSocketFactory(sc.getSocketFactory());

    That should do the Trick.