I read in an article that HttpsURLConnection
will transparently negotiate the SSL connection.
The official document says:
This class uses HostnameVerifier and SSLSocketFactory. There are default implementations defined for both classes. [1]
Does that mean once you open a connection with
httpsCon = (HttpsURLConnection) url.openConnection();
It is already SSL/TLS encrypted without any more hassle?
How can I view and set the TLS version for the standard implementation? (Should be TLS 1.2 for Java 8 and TLS 1.0 for Java 7)
You will have to create an SSLContext
to set the Protocoll:
in Java 1.8:
SSLContext sc = SSLContext.getInstance("TLSv1.2");
// Init the SSLContext with a TrustManager[] and SecureRandom()
sc.init(null, trustCerts, new java.security.SecureRandom());
in Java 1.7:
SSLContext sc = SSLContext.getInstance("TLSv1");
// Init the SSLContext with a TrustManager[] and SecureRandom()
sc.init(null, trustCerts, new java.security.SecureRandom());
then you just have to set the SSLContext to the HttpsURLConnection:
httpsCon.setSSLSocketFactory(sc.getSocketFactory());
That should do the Trick.