从 Java 6 使用 TLS 1.2

Question

We have a legacy web application that runs in a tomcat under java 6, upgrading to 7 or 8 is infeasible as the application needs significant work to allow this and the fixes required are too large to implement in a legacy application. We now have a requirement to connect outbound (ie as a client) over TLS 1.2 however java 6 only supports 1.0. We use Apache as our web-server and OpenSSL for incoming connections and this happily supports TLS 1.2 etc.

Has anyone had to address a similar issue, or can you comment on the following potential work arounds:

• Loopback to localhost (or otherwise redirect) and use OpenSSL to create a TLS 1.2 connection,
  • effectively an internal proxy
  • can openssl be a client?
  • do we need s_client?
• Use our current the firewall to upgrade the connection
  • this would need to be selective
  • Obviously implementing this will depend on the firewall
• Use “Bouncy Castle” ( https://www.bouncycastle.org/ )

Answer 1

Don't use openssl's s_client for this - it's slow, and intended more for debugging/testing.

Try using stunnel . It's designed for use cases like yours, and you can find plenty of example configs to get you started. You'd want to make sure to include the sslVersion = TLSv1.2 directive in your configuration to force use of TLS 1.2.