BCJSSE, JDK5 and SSLSocketFactory.getDefault()
Veit Guna <[email protected]>
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <[email protected]> |
Hi. I've succesfully integrated BCJSSE programmatically using JDK5 and HttpsUrlConnection being able to finally connect to TLSv1.2 webservices. Basically by creating the SSLContext using the BCJSSE provider and initializing it using a TrustManagerFactory and KeyManagerFactory. Then getting the SSLSocketFactory via context.getSSLSocketFactory(); and setting it on the HttpsUrlConnection. So far so good. Now I'm wondering, how to achieve the same result, without having to touch any code :). Since HttpsUrlConnection and e.g. Apache Commons HttpClient are using SSLSocketFactory.getDefault(), I currently don't see a way to do this in JDK5. The BCJSSE documentation I found here: https://downloads.bouncycastle.org/fips-java/BC-FJA-(D)TLSUserGuide-1.0.0.pdf states, that getDefault() will only return the BCJSSE SSLSocketFactory, if the Provider is registered before the Sun JSSE one in java.security. I tried it, but it didn't work out. It still returns the Sun JSSE one. Taking a look at the JDK5 SSLSocketFactory.getDefault() implementation shows, that it tries to load a povider, specified via 'ssl.SocketFactory.provider' system property. But this requires a no-args ctor, which the BC package private ProvSSLSocketFactory doesn't provide. So this would fail if one would try to override the default one. Not specifying it via system property, defaults to 'com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl' which is then instantiated and used. Now I'm wondering, how SSLSockerFactory.getDefault(); should ever return the BC one :D. Could somebody please shed some light on this, how the mechanism described in the doc works for JDK5? All I could imagine would be, to create my own SSLSocketFactory Provider implementation, setting up the BC SSLContext within that and returning the BC SSLSocketFactory from it. Then registering it via mentioned system property. Any other ways to do it? Cheers, Veit