BCJSSE, JDK5 and SSLSocketFactory.getDefault()

Veit Guna <[email protected]>
Newsgroups gmane.comp.encryption.bouncy-castle.devel
Message-ID <[email protected]>
Hi.

I've succesfully integrated BCJSSE programmatically using JDK5 and
HttpsUrlConnection being able to finally connect to TLSv1.2 webservices.

Basically by creating the SSLContext using the BCJSSE provider and
initializing it using a TrustManagerFactory and KeyManagerFactory.
Then getting the SSLSocketFactory via context.getSSLSocketFactory(); and
setting it on the HttpsUrlConnection.

So far so good. Now I'm wondering, how to achieve the same result,
without having to touch any code :).
Since HttpsUrlConnection and e.g. Apache Commons HttpClient are using
SSLSocketFactory.getDefault(), I currently don't see a way to do this in
JDK5.

The BCJSSE documentation I found here:

https://downloads.bouncycastle.org/fips-java/BC-FJA-(D)TLSUserGuide-1.0.0.pdf

states, that getDefault() will only return the BCJSSE SSLSocketFactory,
if the Provider is registered before the Sun JSSE one in java.security.
I tried it, but it didn't work out. It still returns the Sun JSSE one.

Taking a look at the JDK5 SSLSocketFactory.getDefault() implementation
shows, that it tries to load a povider, specified via
'ssl.SocketFactory.provider' system property.
But this requires a no-args ctor, which the BC package private
ProvSSLSocketFactory doesn't provide. So this would fail if one would
try to override the default one.

Not specifying it via system property, defaults to
'com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl' which is then
instantiated and used.
Now I'm wondering, how SSLSockerFactory.getDefault(); should ever return
the BC one :D.

Could somebody please shed some light on this, how the mechanism
described in the doc works for JDK5?

All I could imagine would be, to create my own SSLSocketFactory Provider
implementation, setting up the BC SSLContext within that and returning
the BC SSLSocketFactory
from it. Then registering it via mentioned system property. Any other
ways to do it?

Cheers,
Veit
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.