How to use TLS 1 2 in Java 6

Question

It seems that Java 6 supports TLS up to v1 0  is there any way to use TLS 1 2 in Java 6   Maybe a patch or a particular update of Java 6 will have support for it

User · Answer

After a few hours of playing with the Oracle JDK 1.6, I was able to make it work without any code change. The magic is done by Bouncy Castle to handle SSL and allow JDK 1.6 to run with TLSv1.2 by default. In theory, it could also be applied to older Java versions with eventual adjustments.

Download the latest Java 1.6 version from the Java Archive Oracle website
Uncompress it on your preferred path and set your JAVA_HOME environment variable
Update the JDK with the latest Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 6
Download the Bounce Castle files bcprov-jdk15to18-165.jar and bctls-jdk15to18-165.jar and copy them into your ${JAVA_HOME}/jre/lib/ext folder
Modify the file ${JAVA_HOME}/jre/lib/security/java.security commenting out the providers section and adding some extra lines

    # Original security providers (just comment it)
    # security.provider.1=sun.security.provider.Sun
    # security.provider.2=sun.security.rsa.SunRsaSign
    # security.provider.3=com.sun.net.ssl.internal.ssl.Provider
    # security.provider.4=com.sun.crypto.provider.SunJCE
    # security.provider.5=sun.security.jgss.SunProvider
    # security.provider.6=com.sun.security.sasl.Provider
    # security.provider.7=org.jcp.xml.dsig.internal.dom.XMLDSigRI
    # security.provider.8=sun.security.smartcardio.SunPCSC

    # Add the Bouncy Castle security providers with higher priority
    security.provider.1=org.bouncycastle.jce.provider.BouncyCastleProvider
    security.provider.2=org.bouncycastle.jsse.provider.BouncyCastleJsseProvider
    
    # Original security providers with different priorities
    security.provider.3=sun.security.provider.Sun
    security.provider.4=sun.security.rsa.SunRsaSign
    security.provider.5=com.sun.net.ssl.internal.ssl.Provider
    security.provider.6=com.sun.crypto.provider.SunJCE 
    security.provider.7=sun.security.jgss.SunProvider
    security.provider.8=com.sun.security.sasl.Provider
    security.provider.9=org.jcp.xml.dsig.internal.dom.XMLDSigRI
    security.provider.10=sun.security.smartcardio.SunPCSC

    # Here we are changing the default SSLSocketFactory implementation
    ssl.SocketFactory.provider=org.bouncycastle.jsse.provider.SSLSocketFactoryImpl

Just to make sure it's working let's make a simple Java program to download files from one URL using https.

import java.io.*;
import java.net.*;


public class DownloadWithHttps {

    public static void main(String[] args) {
        try {
            URL url = new URL(args[0]);
            System.out.println("File to Download: " + url);
            String filename = url.getFile();
            File f = new File(filename);
            System.out.println("Output File: " + f.getName());
            BufferedInputStream in = new BufferedInputStream(url.openStream());
            FileOutputStream fileOutputStream = new FileOutputStream(f.getName());
            int bytesRead;
            byte dataBuffer[] = new byte[1024];

            while ((bytesRead = in.read(dataBuffer, 0, 1024)) != -1) {
                fileOutputStream.write(dataBuffer, 0, bytesRead);
            }
            fileOutputStream.close();

        } catch (Exception ex) {
            ex.printStackTrace();
        }

    }
}

Now, just compile the DownloadWithHttps.java program and execute it with your Java 1.6


${JAVA_HOME}/bin/javac DownloadWithHttps.java
${JAVA_HOME}/bin/java DownloadWithHttps https://repo1.maven.org/maven2/org/apache/commons/commons-lang3/3.10/commons-lang3-3.10.jar

Important note for Windows users: This solution was tested in a Linux OS, if you are using Windows, please replace the ${JAVA_HOME} by %JAVA_HOME%.

User · Answer

Java 6  now support TLS 1 2  check out below  http   www oracle com technetwork java javase overview-156328 html R160 121

User · Answer

I also got a similar error when forced to use TLS1 2 for java 6  And I handled it thanks to this library   Clone Source Code  https   github com tobszarny ssl-provider-jvm16  Add Main Class  public static void main String   args  throws Exception       try           String apiUrl    quot https   domain api query test 123 quot            URL myurl   new URL apiUrl           HttpsURLConnection con    HttpsURLConnection  myurl openConnection            con setSSLSocketFactory new TSLSocketConnectionFactory             int responseCode   con getResponseCode            System out println  quot GET Response Code     quot    responseCode         catch  Exception ex            ex printStackTrace

User · Answer

I think that the solution of  Azimuts  https   stackoverflow com a 33375677 6503697  is for HTTP only connection   For FTPS connection you can use Bouncy Castle with org apache commons net ftp FTPSClient without the need for rewrite FTPS protocol   I have a program running on JRE 1 6 0 04 and I can not update the JRE    The program has to connect to an FTPS server that work only with TLS 1 2  IIS server    I struggled for days and finally I have understood that there are few versions of bouncy castle library right in my use case  bctls-jdk15on-1 60 jar and bcprov-jdk15on-1 60 jar are ok  but 1 64 versions are not   The version of apache commons-net is 3 1    Following is a small snippet of code that should work   import java io ByteArrayOutputStream  import java security SecureRandom  import java security Security   import javax net ssl SSLContext  import javax net ssl TrustManager  import javax net ssl X509TrustManager   import org apache commons net ftp FTP  import org apache commons net ftp FTPReply  import org apache commons net ftp FTPSClient  import org bouncycastle jce provider BouncyCastleProvider  import org bouncycastle jsse provider BouncyCastleJsseProvider  import org junit Test    public class FtpsTest       Create a trust manager that does not validate certificate chains TrustManager   trustAllCerts   new TrustManager     new X509TrustManager          public java security cert X509Certificate   getAcceptedIssuers             return null             public void checkClientTrusted java security cert X509Certificate   certs  String authType               public void checkServerTrusted java security cert X509Certificate   certs  String authType                 Test public void test   throws Exception         Security insertProviderAt new BouncyCastleProvider    1       Security addProvider new BouncyCastleJsseProvider           SSLContext sslContext   SSLContext getInstance  TLS   new BouncyCastleJsseProvider         sslContext init null  trustAllCerts  new SecureRandom         org apache commons net ftp FTPSClient ftpClient   new FTPSClient sslContext       ByteArrayOutputStream out   null      try            ftpClient connect  hostaname   21           if   FTPReply isPositiveCompletion ftpClient getReplyCode                   String msg    Il server ftp ha rifiutato la connessione                throw new Exception msg                     if   ftpClient login  username    pwd                  String msg    Il server ftp ha rifiutato il login con username   username  e pwd   password                  ftpClient disconnect                throw new Exception msg                       ftpClient enterLocalPassiveMode            ftpClient setFileType FTP BINARY FILE TYPE           ftpClient setDataTimeout 60000           ftpClient execPBSZ 0      Set protection buffer size         ftpClient execPROT  P       Set data channel protection to private         int bufSize   1024   1024     1MB         ftpClient setBufferSize bufSize           out   new ByteArrayOutputStream bufSize           ftpClient retrieveFile  remoteFileName   out           out toByteArray              finally           if  out    null                out close                      ftpClient disconnect

User · Answer

In case you need to access a specific set of remote services you could use an intermediate reverse-proxy  to perform tls1 2 for you  This would save you from trying to patch or upgrade java1 6   e g  app -  proxy http 5500  tls-1 2  -  remote https 443   Configuration in its simplest form  one port per service  for apache httpd is   Listen 127 0 0 1 5000  lt VirtualHost   5500 gt      SSLProxyEngine On     ProxyPass   https   remote-domain      ProxyPassReverse   https   remote-domain   lt  VirtualHost gt    Then instead of accessing https   remote-domain  you access http   localhost 5500

User · Answer

Here a TLSConnection Factory    package test connection   import java io ByteArrayInputStream  import java io ByteArrayOutputStream  import java io DataOutputStream  import java io IOException  import java io InputStream  import java io OutputStream  import java net InetAddress  import java net InetSocketAddress  import java net Socket  import java net UnknownHostException  import java security Principal  import java security SecureRandom  import java security Security  import java security cert CertificateException  import java security cert CertificateFactory  import java util Hashtable  import java util LinkedList  import java util List   import javax net ssl HandshakeCompletedEvent  import javax net ssl HandshakeCompletedListener  import javax net ssl SSLPeerUnverifiedException  import javax net ssl SSLSession  import javax net ssl SSLSessionContext  import javax net ssl SSLSocket  import javax net ssl SSLSocketFactory  import javax security cert X509Certificate   import org bouncycastle crypto tls Certificate  import org bouncycastle crypto tls CertificateRequest  import org bouncycastle crypto tls DefaultTlsClient  import org bouncycastle crypto tls ExtensionType  import org bouncycastle crypto tls TlsAuthentication  import org bouncycastle crypto tls TlsClientProtocol  import org bouncycastle crypto tls TlsCredentials  import org bouncycastle jce provider BouncyCastleProvider          This Class enables TLS V1 2  connection based on BouncyCastle Providers     Just to use      URL myurl   new URL   http       URL tha only Works in TLS 1 2      HttpsURLConnection  con    HttpsURLConnection  myurl openConnection       con setSSLSocketFactory new TSLSocketConnectionFactory           author AZIMUTS        public class TSLSocketConnectionFactory extends SSLSocketFactory                                                                                                                        Adding Custom BouncyCastleProvider                                                                                                                     static       if  Security getProvider BouncyCastleProvider PROVIDER NAME     null          Security addProvider new BouncyCastleProvider                                                                                                                               HANDSHAKE LISTENER                                                                                                                      public class TLSHandshakeListener implements HandshakeCompletedListener            Override         public void handshakeCompleted HandshakeCompletedEvent event                                                                                                                                       SECURE RANDOM                                                                                                                      private SecureRandom  secureRandom   new SecureRandom                                                                                                                      Adding Custom BouncyCastleProvider                                                                                                                       Override     public Socket createSocket Socket socket  final String host  int port  boolean arg3              throws IOException           if  socket    null                socket   new Socket                      if   socket isConnected                  socket connect new InetSocketAddress host  port                       final TlsClientProtocol tlsClientProtocol   new TlsClientProtocol socket getInputStream    socket getOutputStream     secureRandom           return  createSSLSocket host  tlsClientProtocol                                                                                                                                                                   SOCKET FACTORY  METHODS                                                                                                                                                           Override     public String   getDefaultCipherSuites                   return null              Override     public String   getSupportedCipherSuites             return null              Override     public Socket createSocket String host  int port  throws IOException UnknownHostException            return null              Override     public Socket createSocket InetAddress host  int port  throws IOException            return null              Override     public Socket createSocket String host  int port  InetAddress localHost              int localPort  throws IOException  UnknownHostException              return null              Override     public Socket createSocket InetAddress address  int port              InetAddress localAddress  int localPort  throws IOException              return null                                                                                                                                                              SOCKET CREATION                                                                                                                                                         private SSLSocket  createSSLSocket final String host   final TlsClientProtocol tlsClientProtocol         return new SSLSocket                         private java security cert Certificate   peertCerts             Override           public InputStream getInputStream   throws IOException                 return tlsClientProtocol getInputStream                            Override           public OutputStream getOutputStream   throws IOException                 return tlsClientProtocol getOutputStream                            Override           public synchronized void close   throws IOException                         tlsClientProtocol close                             Override            public void addHandshakeCompletedListener HandshakeCompletedListener arg0                                         Override             public boolean getEnableSessionCreation                              return false                              Override             public String   getEnabledCipherSuites                               return null                              Override             public String   getEnabledProtocols                        TODO Auto-generated method stub                 return null                              Override             public boolean getNeedClientAuth                             return false                              Override             public SSLSession getSession                        return new SSLSession                           Override                     public int getApplicationBufferSize                                              return 0                                              Override                     public String getCipherSuite                              throw new UnsupportedOperationException                                                Override                     public long getCreationTime                              throw new UnsupportedOperationException                                                Override                     public byte   getId                              throw new UnsupportedOperationException                                                Override                     public long getLastAccessedTime                              throw new UnsupportedOperationException                                                Override                     public java security cert Certificate   getLocalCertificates                              throw new UnsupportedOperationException                                                Override                     public Principal getLocalPrincipal                              throw new UnsupportedOperationException                                                Override                     public int getPacketBufferSize                              throw new UnsupportedOperationException                                                Override                     public X509Certificate   getPeerCertificateChain                               throws SSLPeerUnverifiedException                              TODO Auto-generated method stub                         return null                                              Override                     public java security cert Certificate   getPeerCertificates  throws SSLPeerUnverifiedException                            return peertCerts                                              Override                     public String getPeerHost                              throw new UnsupportedOperationException                                                Override                     public int getPeerPort                                                   return 0                                              Override                     public Principal getPeerPrincipal   throws SSLPeerUnverifiedException                         return null                             throw new UnsupportedOperationException                                                 Override                     public String getProtocol                              throw new UnsupportedOperationException                                                Override                     public SSLSessionContext getSessionContext                              throw new UnsupportedOperationException                                                Override                     public Object getValue String arg0                             throw new UnsupportedOperationException                                                Override                     public String   getValueNames                              throw new UnsupportedOperationException                                                Override                     public void invalidate                              throw new UnsupportedOperationException                                                 Override                     public boolean isValid                              throw new UnsupportedOperationException                                                Override                     public void putValue String arg0  Object arg1                             throw new UnsupportedOperationException                                                 Override                     public void removeValue String arg0                             throw new UnsupportedOperationException                                                                               Override             public String   getSupportedProtocols                            return null                              Override             public boolean getUseClientMode                                  return false                              Override             public boolean getWantClientAuth                      return false                              Override             public void removeHandshakeCompletedListener HandshakeCompletedListener arg0                                              Override             public void setEnableSessionCreation boolean arg0                                  Override             public void setEnabledCipherSuites String   arg0                                          Override             public void setEnabledProtocols String   arg0                                  Override             public void setNeedClientAuth boolean arg0                                            Override             public void setUseClientMode boolean arg0                                             Override             public void setWantClientAuth boolean arg0                                                Override             public String   getSupportedCipherSuites                                 return null                             Override             public void startHandshake   throws IOException                     tlsClientProtocol connect new DefaultTlsClient                                                      Override                           public Hashtable lt Integer  byte   gt  getClientExtensions   throws IOException                                   Hashtable lt Integer  byte   gt  clientExtensions   super getClientExtensions                                    if  clientExtensions    null                                        clientExtensions   new Hashtable lt Integer  byte   gt                                                                          Add host name                                 byte   host name   host getBytes                                     final ByteArrayOutputStream baos   new ByteArrayOutputStream                                    final DataOutputStream dos   new DataOutputStream baos                                   dos writeShort host name length   3      entry size                                 dos writeByte 0      name type   hostname                                 dos writeShort host name length                                   dos write host name                                   dos close                                    clientExtensions put ExtensionType server name  baos toByteArray                                     return clientExtensions                                                      Override                         public TlsAuthentication getAuthentication                                   throws IOException                               return new TlsAuthentication                                        Override                                 public void notifyServerCertificate Certificate serverCertificate  throws IOException                                      try                                           CertificateFactory cf   CertificateFactory getInstance  X 509                                            List lt java security cert Certificate gt  certs   new LinkedList lt java security cert Certificate gt                                             for   org bouncycastle asn1 x509 Certificate c   serverCertificate getCertificateList                                                                                            certs add cf generateCertificate new ByteArrayInputStream c getEncoded                                                                                         peertCerts   certs toArray new java security cert Certificate 0                                          catch  CertificateException e                                                                              System out println   Failed to cache server certs   e                                          throw new IOException e                                                                                                              Override                                 public TlsCredentials getClientCredentials CertificateRequest arg0                                          throws IOException                                                                           return null                                                                                                                                                     Socket            Remember that to prove this is  the best is to test against a website that exposes ONLY TLS 1 2  If the web exposes TLS 1 0  TLS 1 1 depending on the Java implementation will connect using tls 1 0  tls 1 1  Test it against a site that only exposes TLS 1 2  An example can be the NIST secure site https   www nist gov

User · Answer

You must create your own SSLSocketFactory based on Bouncy Castle  After to use it  pass to the common HttpsConnextion for using this customized SocketFactory  1  First   Create a TLSConnectionFactory Here one  tips  1 1 Extend SSLConnectionFactory 1 2 Override this method    Override  public Socket createSocket Socket socket  final String host  int port  boolean arg3   This method will call the next internal method  1 3 Implement an internal method   createSSLSocket host  tlsClientProtocol   Here you must create a Socket using TlsClientProtocol   The trick is override    startHandshake   method calling TlsClientProtocol  private SSLSocket  createSSLSocket final String host   final TlsClientProtocol tlsClientProtocol         return new SSLSocket                     Override and implement SSLSocket methods   particulary               startHandshake                                       Important   The full sample how to use TLS Client Protocol is well explained here  Using BouncyCastle for a simple HTTPS query 2  Second   Use this Customized  SSLConnextionFactory on common HTTPSConnection  This is important    In other samples you can see into the web   u see hard-coded HTTP Commands    so with a customized SSLConnectionFactory u don t need nothing more      URL myurl   new URL   quot http       URL tha only Works in TLS 1 2     HttpsURLConnection  con    HttpsURLConnection  myurl openConnection      con setSSLSocketFactory new TSLSocketConnectionFactory

User · Answer

Public Oracle Java 6 releases do not support TLSv1 2   Paid-for releases of Java 6  post-EOL  might   UPDATE - TLSv1 1 is available for Java 1 6 from update 111 onwards  source    Contact Oracle sales   Other alternatives are    Use an alternative JCE implementation such as Bouncy Castle   See this answer for details on how to do it   It changes the default SSLSocketFactory implementation  so that your application will use BC transparently    Other answers show how to use the BC SSLSocketFactory implementation explicitly  but that approach will entail modifying application or library code that that is opening sockets   Use an IBM Java 6     if available for your platform   According to  IBM SDK  Java Technology Edition fixes to mitigate against the POODLE security vulnerability  CVE-2014-3566         TLSv1 1 and TLSv1 2 are available only for Java 6 service refresh 10  Java 6 0 1 service refresh 1  J9 VM2 6   and later releases        However  I d advise upgrading to a Java 11  now    Java 6 was EOL d in Feb 2013  and continuing to use it is potentially risky   Free Oracle Java 8 is EOL for many use-cases    Tell or remind the boss   the client   They need to know

[java] How to use TLS 1.2 in Java 6

Examples related to java

Examples related to ssl

Examples related to java-6

Examples related to tls1.2