如何在使用Apache HTTP Client时设置EnabledCipherSuite？

Question

Since I need to work with some legacy server, and since RC4 was removed from the Java 8, I need to re-enable some RC4 based ciphers. As described in the release note we have to use SSLSocket/SSLEngine.setEnabledCipherSuites() . Since I'm using Apache HTTP Client I was not able to find a way to do this. Thanks in advance! (I also found quite semitrailer problem with out an answer so thought of posting a new one)

Answer 1

I was facing the same problem and I was able to figure this out.

SecureProtocolSocketFactoryImpl protFactory = new SecureProtocolSocketFactoryImpl();
httpsClient.getHostConfiguration().setHost(host, port, httpsProtocol);

In the "SecureProtocolSocketFactoryImpl" class you have to override the method public Socket createSocket() for SecureProtocolSocketFactory class.

In that method you will get a socket like this

 SSLSocket soc = (SSLSocket) getSSLContext().getSocketFactory().createSocket(
                    socket,
                    host,
                    port,
                    autoClose
                );

So there you will be able to do something like below.

ciphersToBeEnabled[0] = "TLS_ECDHE_ECDSA_WITH_RC4_128_SHA";
soc.setEnabledCipherSuites(ciphersToBeEnabled);

hope you get the idea. If you have any problems please comment below. Note that doing this only will not enable RC4 related ciphers. You will need to modify java "java.security" file in jre/lib/security/ file and remove CR4 form the disabled algorithm list.

Answer 2

The recommended way to get the HttpClient is by using HttpClientBuilder . In this builder, you can set the HttpClientConnectionManager which in turn can take a Registry<ConnectionSocketFactory> . In this ConnectionSocketFactory , you can configure ciphers and protocols that the client want to restrict.

Sample Code:

Registry<ConnectionSocketFactory> socketFactoryRegistry;
    {
        SSLContext sslcontext = <your SSLContext>;
        socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
            .register("http", new PlainConnectionSocketFactory())
            .register("https", new SSLConnectionSocketFactory(sslcontext,
                                    <your supported protocols, could be null>,
                                    <your supported ciphers, could be null>,
                                    <your HostnameVerifier>
            .build();
    }

HttpClientBuilder b = HttpClientBuilder.create()
    .setConnectionManager(new BasicHttpClientConnectionManager(socketFactoryRegistry))
    .set<anything else you want>(<with what you want>);

HttpClient client = b.build();