How to set TLS version on apache HttpClient

Question

How can I change the supported TLS versions on my HttpClient?

I'm doing:

SSLContext sslContext = SSLContext.getInstance("TLSv1.1");
sslContext.init(
    keymanagers.toArray(new KeyManager[keymanagers.size()]),
    null,
    null);

SSLSocketFactory socketFactory = new SSLSocketFactory(sslContext, new String[]{"TLSv1.1"}, null, null);
Scheme scheme = new Scheme("https", 443, socketFactory);
SchemeRegistry schemeRegistry = new SchemeRegistry();
schemeRegistry.register(scheme);
BasicClientConnectionManager cm = new BasicClientConnectionManager(schemeRegistry);
httpClient = new DefaultHttpClient(cm);

But when I check the created socket, it still says the supported protocols are TLSv1.0, TLSv1.1 and TLSv1.2.

In reality I just want it to stop using TLSv1.2, for this specific HttpClient.

Answer 1

The solution is:

SSLContext sslContext = SSLContexts.custom()     .useTLS()     .build();  SSLConnectionSocketFactory f = new SSLConnectionSocketFactory(     sslContext,     new String[]{"TLSv1", "TLSv1.1"},        null,     BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);  httpClient = HttpClients.custom()     .setSSLSocketFactory(f)     .build(); 

This requires org.apache.httpcomponents.httpclient 4.3.x though.

Answer 2

This is how I got it working on httpClient 4.5 (as per Olive Tree request):

CredentialsProvider credsProvider = new BasicCredentialsProvider(); credsProvider.setCredentials(         new AuthScope(AuthScope.ANY_HOST, 443),         new UsernamePasswordCredentials(this.user, this.password));  SSLContext sslContext = SSLContexts.createDefault();  SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext,         new String[]{"TLSv1", "TLSv1.1"},         null,         new NoopHostnameVerifier());  CloseableHttpClient httpclient = HttpClients.custom()         .setDefaultCredentialsProvider(credsProvider)         .setSSLSocketFactory(sslsf)         .build();  return httpclient; 

Answer 3

HttpClient-4.5,Use TLSv1.2 ,You must code like this:

 //Set the https use TLSv1.2
private static Registry<ConnectionSocketFactory> getRegistry() throws KeyManagementException, NoSuchAlgorithmException {
    SSLContext sslContext = SSLContexts.custom().build();
    SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext,
            new String[]{"TLSv1.2"}, null, SSLConnectionSocketFactory.getDefaultHostnameVerifier());
    return RegistryBuilder.<ConnectionSocketFactory>create()
            .register("http", PlainConnectionSocketFactory.getSocketFactory())
            .register("https", sslConnectionSocketFactory)
            .build();
}

public static void main(String... args) {
    try {
        //Set the https use TLSv1.2
        PoolingHttpClientConnectionManager clientConnectionManager = new PoolingHttpClientConnectionManager(getRegistry());
        clientConnectionManager.setMaxTotal(100);
        clientConnectionManager.setDefaultMaxPerRoute(20);
        HttpClient client = HttpClients.custom().setConnectionManager(clientConnectionManager).build();
        //Then you can do : client.execute(HttpGet or HttpPost);
    } catch (KeyManagementException | NoSuchAlgorithmException e) {
        e.printStackTrace();
    }
}