Quantcast
Channel: Active questions tagged https - Stack Overflow
Viewing all articles
Browse latest Browse all 1493

Is it possible to remove the extension part of SSL handshakes in Java?

$
0
0

There is a legacy Cisco IPS server which I am trying to connect to using https. The problem is this server only accepts handshakes with certain conditions:

The version must be TLSv1.0, the cipher suite must be SSL_RSA_WITH_RC4_128_MD5 or SSL_RSA_WITH_RC4_128_SHA and there mustn't be any extensions.

I implemented a hand-made "ClientHello" which sends the following info as handshake (wireshark output):

Secure Sockets LayerTLSv1.2 Record Layer: Handshake Protocol: Client Hello    Content Type: Handshake (22)    Version: TLS 1.0 (0x0301)    Length: 45    Handshake Protocol: Client Hello        Handshake Type: Client Hello (1)        Length: 41        Version: TLS 1.0 (0x0301)        Random        Session ID Length: 0        Cipher Suites Length: 2        Cipher Suites (1 suite)        Compression Methods Length: 1        Compression Methods (1 method)

The server sends back the ServerHello message.

Now I want to use Java's SSL implementation to send exactly the same ClientHello. The following code:

    System.setProperty("https.protocols", "TLSv1");    System.setProperty("javax.net.debug", "ssl:handshake");    SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();    SSLSocket socket = (SSLSocket) factory.createSocket("ips-server", 443);    socket.setEnabledProtocols(new String[] {"TLSv1"});    socket.setEnabledCipherSuites(new String[] {"SSL_RSA_WITH_RC4_128_MD5"});    socket.startHandshake();

produces the following handshake:

Secure Sockets LayerTLSv1.2 Record Layer: Handshake Protocol: Client Hello    Content Type: Handshake (22)    Version: TLS 1.0 (0x0301)    Length: 52    Handshake Protocol: Client Hello        Handshake Type: Client Hello (1)        Length: 48        Version: TLS 1.0 (0x0301)        Random        Session ID Length: 0        Cipher Suites Length: 2        Cipher Suites (1 suite)        Compression Methods Length: 1        Compression Methods (1 method)        Extensions Length: 5        Extension: renegotiation_info            Type: renegotiation_info (0xff01)            Length: 1            Renegotiation Info extension

This causes the server to send back the following packet:

TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Handshake Failure)

Is it possible to make Java not send the "extension" part of the packet?


Viewing all articles
Browse latest Browse all 1493

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>