如何在Java 6中使用TLS 1.2
看来Java 6支持高达v1.0的TLS，有没有办法在Java 6中使用TLS 1.2？
也许Java 6的补丁或特定更新会支持它？
公共Oracle Java 6发行版不支持TLSv1.2。 支付版本的Java 6（后EOL）可能会。 （ UPDATE – TLSv1.1从更新111开始可用于Java 1.6; 源代码 ）
联系Oracle销售人员。
其他替代方案是：
-
使用另一种JCE实现，例如Bouncy Castle。
-
使用IBM Java 6 …如果适用于您的平台。 根据“IBM SDK，Java Technology Edition修复以缓解POODLE安全漏洞（CVE-2014-3566）” ：
“TLSv1.1和TLSv1.2仅适用于Java 6服务更新10，Java 6.0.1服务更新1（J9 VM2.6）和更高版本。”
但是，我建议升级到Java 8. 2013年2月，Java 6已经过EOL，并继续使用它可能存在风险。 （告诉或提醒老板/客户。他们需要知道。）
这里有一个TLSConnection工厂：
package test.connection; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.DataOutputStream; import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; import java.net.InetAddress; import java.net.InetSocketAddress; import java.net.Socket; import java.net.UnknownHostException; import java.security.Principal; import java.security.SecureRandom; import java.security.Security; import java.security.cert.CertificateException; import java.security.cert.CertificateFactory; import java.util.Hashtable; import java.util.LinkedList; import java.util.List; import javax.net.ssl.HandshakeCompletedEvent; import javax.net.ssl.HandshakeCompletedListener; import javax.net.ssl.SSLPeerUnverifiedException; import javax.net.ssl.SSLSession; import javax.net.ssl.SSLSessionContext; import javax.net.ssl.SSLSocket; import javax.net.ssl.SSLSocketFactory; import javax.security.cert.X509Certificate; import org.bouncycastle.crypto.tls.Certificate; import org.bouncycastle.crypto.tls.CertificateRequest; import org.bouncycastle.crypto.tls.DefaultTlsClient; import org.bouncycastle.crypto.tls.ExtensionType; import org.bouncycastle.crypto.tls.TlsAuthentication; import org.bouncycastle.crypto.tls.TlsClientProtocol; import org.bouncycastle.crypto.tls.TlsCredentials; import org.bouncycastle.jce.provider.BouncyCastleProvider; /** * This Class enables TLS V1.2 connection based on BouncyCastle Providers. * Just to use: * URL myurl = new URL( "http:// ...URL tha only Works in TLS 1.2); HttpsURLConnection con = (HttpsURLConnection )myurl.openConnection(); con.setSSLSocketFactory(new TSLSocketConnectionFactory()); * @author AZIMUTS * */ public class TSLSocketConnectionFactory extends SSLSocketFactory { ////////////////////////////////////////////////////////////////////////////////////////////////////////////// //Adding Custom BouncyCastleProvider /////////////////////////////////////////////////////////////////////////////////////////////////////////////// static { if (Security.getProvider(BouncyCastleProvider.PROVIDER_NAME) == null) Security.addProvider(new BouncyCastleProvider()); } ////////////////////////////////////////////////////////////////////////////////////////////////////////////// //HANDSHAKE LISTENER /////////////////////////////////////////////////////////////////////////////////////////////////////////////// public class TLSHandshakeListener implements HandshakeCompletedListener { @Override public void handshakeCompleted(HandshakeCompletedEvent event) { } } ////////////////////////////////////////////////////////////////////////////////////////////////////////////// //SECURE RANDOM /////////////////////////////////////////////////////////////////////////////////////////////////////////////// private SecureRandom _secureRandom = new SecureRandom(); ////////////////////////////////////////////////////////////////////////////////////////////////////////////// //Adding Custom BouncyCastleProvider /////////////////////////////////////////////////////////////////////////////////////////////////////////////// @Override public Socket createSocket(Socket socket, final String host, int port, boolean arg3) throws IOException { if (socket == null) { socket = new Socket(); } if (!socket.isConnected()) { socket.connect(new InetSocketAddress(host, port)); } final TlsClientProtocol tlsClientProtocol = new TlsClientProtocol(socket.getInputStream(), socket.getOutputStream(), _secureRandom); return _createSSLSocket(host, tlsClientProtocol); } ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // SOCKET FACTORY METHODS ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// @Override public String[] getDefaultCipherSuites() { return null; } @Override public String[] getSupportedCipherSuites(){ return null; } @Override public Socket createSocket(String host, int port) throws IOException,UnknownHostException{ return null; } @Override public Socket createSocket(InetAddress host, int port) throws IOException { return null; } @Override public Socket createSocket(String host, int port, InetAddress localHost, int localPort) throws IOException, UnknownHostException { return null; } @Override public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException{ return null; } ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //SOCKET CREATION ////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// private SSLSocket _createSSLSocket(final String host , final TlsClientProtocol tlsClientProtocol) { return new SSLSocket() { private java.security.cert.Certificate[] peertCerts; @Override public InputStream getInputStream() throws IOException { return tlsClientProtocol.getInputStream(); } @Override public OutputStream getOutputStream() throws IOException { return tlsClientProtocol.getOutputStream(); } @Override public synchronized void close() throws IOException { tlsClientProtocol.close(); } @Override public void addHandshakeCompletedListener(HandshakeCompletedListener arg0) { } @Override public boolean getEnableSessionCreation() { return false; } @Override public String[] getEnabledCipherSuites() { return null; } @Override public String[] getEnabledProtocols() { // TODO Auto-generated method stub return null; } @Override public boolean getNeedClientAuth(){ return false; } @Override public SSLSession getSession() { return new SSLSession() { @Override public int getApplicationBufferSize() { return 0; } @Override public String getCipherSuite() { throw new UnsupportedOperationException(); } @Override public long getCreationTime() { throw new UnsupportedOperationException(); } @Override public byte[] getId() { throw new UnsupportedOperationException(); } @Override public long getLastAccessedTime() { throw new UnsupportedOperationException(); } @Override public java.security.cert.Certificate[] getLocalCertificates() { throw new UnsupportedOperationException(); } @Override public Principal getLocalPrincipal() { throw new UnsupportedOperationException(); } @Override public int getPacketBufferSize() { throw new UnsupportedOperationException(); } @Override public X509Certificate[] getPeerCertificateChain() throws SSLPeerUnverifiedException { // TODO Auto-generated method stub return null; } @Override public java.security.cert.Certificate[] getPeerCertificates()throws SSLPeerUnverifiedException { return peertCerts; } @Override public String getPeerHost() { throw new UnsupportedOperationException(); } @Override public int getPeerPort() { return 0; } @Override public Principal getPeerPrincipal() throws SSLPeerUnverifiedException { return null; //throw new UnsupportedOperationException(); } @Override public String getProtocol() { throw new UnsupportedOperationException(); } @Override public SSLSessionContext getSessionContext() { throw new UnsupportedOperationException(); } @Override public Object getValue(String arg0) { throw new UnsupportedOperationException(); } @Override public String[] getValueNames() { throw new UnsupportedOperationException(); } @Override public void invalidate() { throw new UnsupportedOperationException(); } @Override public boolean isValid() { throw new UnsupportedOperationException(); } @Override public void putValue(String arg0, Object arg1) { throw new UnsupportedOperationException(); } @Override public void removeValue(String arg0) { throw new UnsupportedOperationException(); } }; } @Override public String[] getSupportedProtocols() { return null; } @Override public boolean getUseClientMode() { return false; } @Override public boolean getWantClientAuth() { return false; } @Override public void removeHandshakeCompletedListener(HandshakeCompletedListener arg0) { } @Override public void setEnableSessionCreation(boolean arg0) { } @Override public void setEnabledCipherSuites(String[] arg0) { } @Override public void setEnabledProtocols(String[] arg0) { } @Override public void setNeedClientAuth(boolean arg0) { } @Override public void setUseClientMode(boolean arg0) { } @Override public void setWantClientAuth(boolean arg0) { } @Override public String[] getSupportedCipherSuites() { return null; } @Override public void startHandshake() throws IOException { tlsClientProtocol.connect(new DefaultTlsClient() { @Override public Hashtable getClientExtensions() throws IOException { Hashtable clientExtensions = super.getClientExtensions(); if (clientExtensions == null) { clientExtensions = new Hashtable(); } //Add host_name byte[] host_name = host.getBytes(); final ByteArrayOutputStream baos = new ByteArrayOutputStream(); final DataOutputStream dos = new DataOutputStream(baos); dos.writeShort(host_name.length + 3); // entry size dos.writeByte(0); // name type = hostname dos.writeShort(host_name.length); dos.write(host_name); dos.close(); clientExtensions.put(ExtensionType.server_name, baos.toByteArray()); return clientExtensions; } @Override public TlsAuthentication getAuthentication() throws IOException { return new TlsAuthentication() { @Override public void notifyServerCertificate(Certificate serverCertificate) throws IOException { try { CertificateFactory cf = CertificateFactory.getInstance("X.509"); List certs = new LinkedList(); for ( org.bouncycastle.asn1.x509.Certificate c : serverCertificate.getCertificateList()) { certs.add(cf.generateCertificate(new ByteArrayInputStream(c.getEncoded()))); } peertCerts = certs.toArray(new java.security.cert.Certificate[0]); } catch (CertificateException e) { System.out.println( "Failed to cache server certs"+ e); throw new IOException(e); } } @Override public TlsCredentials getClientCredentials(CertificateRequest arg0) throws IOException { return null; } }; } }); } };//Socket } } 请记住，为了certificate这一点，最好是针对仅公开TLS 1.2的网站进行测试。 如果Web公开TLS 1.0，则根据Java实现的TLS 1.1将使用tls 1.0，tls 1.1进行连接。 针对仅暴露TLS 1.2的站点进行测试。 一个例子可以是NIST安全站点https://www.nist.gov
Java 6，现在支持TLS 1.2，请查看下面的内容
http://www.oracle.com/technetwork/java/javase/overview-156328.html#R160_121
您必须基于Bouncy Castle创建自己的SSLSocketFactory。 使用它之后，传递给常见的HttpsConnextion以使用这个自定义的SocketFactory。
1.首先：创建一个TLSConnectionFactory
这里有一个提示：
1.1扩展SSLConnectionFactory
1.2覆盖此方法：
@Override public Socket createSocket(Socket socket, final String host, int port, boolean arg3)
这个方法将调用下一个内部方法，
1.3实现内部方法_createSSLSocket（host，tlsClientProtocol）;
在这里，您必须使用TlsClientProtocol创建一个Socket。 诀窍是覆盖… startHandshake（）方法调用TlsClientProtocol
private SSLSocket _createSSLSocket(final String host , final TlsClientProtocol tlsClientProtocol) { return new SSLSocket() { .... Override and implement SSLSocket methods, particulary: startHandshake() { } }
重要提示：此处详细说明了如何使用TLS客户端协议的完整示例： 使用BouncyCastle进行简单的HTTPS查询
2.第二：在常见HTTPSConnection上使用此自定义SSLConnextionFactory。
这个很重要 ！ 在其他示例中，您可以看到网络，你看到硬编码的HTTP命令….所以使用自定义的SSLConnectionFactory你不需要更多……
URL myurl = new URL( "http:// ...URL tha only Works in TLS 1.2); HttpsURLConnection con = (HttpsURLConnection )myurl.openConnection(); con.setSSLSocketFactory(new TSLSocketConnectionFactory());