Issues with setting https.protocols System Property for HTTPS connections

Question

I have a Java Implementation which used by various client applications to connects to to the third party systems. These third party systems supports different protocols over http/https. In this case, all client applications are hosted in the same server where my Java Implementation hosted. So,in this case, various client applications set various https protocols to the System properties (eg: System.setProperty("https.protocols", "SSLv3") , System.setProperty("https.protocols", "TLS") when they are using this to connect to those third party systems.

Here, the System properties are shared among all the applications in that environment. So, modifying a System property leads to many problems. So, I want to know,

Is there any way to get this done without using System properties?
Is there any way to set all the possible https.protocols so that it supports any http or https connection made to the third party systems supports various protocols?

Protocols and algorithms supported in each JDK version as mentioned in blogs.oracle.com:

Code :

String responseStr = null;

System.setProperty("https.protocols",http-protocol); // This is set by the client applications. Previously, there was one by one (eg : "SSLv3". Then I changed it to "TLSv1.2,TLSv1.1,TLSv1,SSLv3" assuming it will enable all) 

byteArrayOutputStream byteArrayOutputStream = new ByteArrayOutputStream();
byteArrayOutputStream.write(requestStr.getBytes());

URL mUrl = new URL(proxy_url);
HttpURLConnection con = (HttpURLConnection) mUrl.openConnection(); // It works fine for the HttpURLConnection when there's no (s)

con.setRequestMethod("POST");
con.setDoOutput(true);
con.setUseCaches(false);
con.setDoInput(true);

con.setRequestProperty("user-agent","Mozilla(MSIE)");
con.setRequestProperty("Accept-Encoding","gzip,deflate");

byteArrayOutputStream.writeTo(con.getOutputStream());

String encodingHeader = con.getHeaderField("Content-Encoding");
InputStream inputStream = null;

if(encodingHeader != null && encodingHeader.toLowerCase().indexOf("gzip") != -1){
    inputStream = new GZIPInputStream(con.getInputStream());
}else {
    inputStream = con.getInputStream();

}

if (inputStream != null) {

    ByteArrayOutputStream baos = new ByteArrayOutputStream();
       byte[] buffer = new byte[4096];
       int length = 0;

       while ((length = inputStream.read(buffer)) != -1) {
           baos.write(buffer, 0, length);
       }

    responseStr = new String(baos.toByteArray());
    baos.close();

 }

My Java version : 1.5

That is very true. But right now there's a big workaround there for that. So, I'm looking for solution in current version — namalfernandolk
The answers to this question may be relevant: superuser.com/questions/747377/… Of note is the Oracle documentation, which shows that while TLS1.2 is supported on Java 1.7, it is disabled by default for client connections. — BryKKan
The ByteArrayOutputStream is a waste of time and space here. — user207421

user207421 user207421 · Accepted Answer · 2015-12-15T10:33:39

I suggest you don't set it at all. Just let the system negotiate with the peer. It will negotiate the strongest shared protocol.

Issues with setting https.protocols System Property for HTTPS connections

1 Answers