在Java 6上使用httpClient 4.3.6在客户端中强制使用协议

Question

For some testing reason I need to force SSLv3 to be used by Client. SSLv3 is an accepted protocol in server. Tried to force by using SSLContextBuilder.useProtocol("SSLv3") as below:

SSLContextBuilder initiated as below:

    SSLContextBuilder builder = SSLContexts.custom();

    SSLContext sslContext = builder.useProtocol("SSLv3").build();

    SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new X509HostnameVerifier() {
        @Override
        public void verify(String host, SSLSocket ssl) throws IOException {
        }
     ....
     ....);
    return sslsf;
}

But the result in log shows handshaking always do in TLSv1:

....
....
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
%% No cached client session
*** ClientHello, TLSv1
RandomCookie:  
GMT: 1503650935 
bytes = { 
255, 
....
....

My understanding, client should request for the protocol that is defined whether server accept or not. In this case, I expect to see client should request to use SSLv3 not TLSv1.

Answer 1

That will force HC 4.3 to use SSLv3 only

SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
        SSLContext.getDefault(), new String[] {"SSLv3"}, null, SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER);
CloseableHttpClient httpClient = HttpClients.custom()
        .setSSLSocketFactory(sslSocketFactory)
        .build();