There is a legacy Cisco IPS server which I am trying to connect to using https. The problem is this server only accepts handshakes with certain conditions:
The version must be TLSv1.0, the cipher suite must be SSL_RSA_WITH_RC4_128_MD5 or SSL_RSA_WITH_RC4_128_SHA and there mustn't be any extensions.
I implemented a hand-made "ClientHello" which sends the following info as handshake (wireshark output):
Secure Sockets LayerTLSv1.2 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 45 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 41 Version: TLS 1.0 (0x0301) Random Session ID Length: 0 Cipher Suites Length: 2 Cipher Suites (1 suite) Compression Methods Length: 1 Compression Methods (1 method)
The server sends back the ServerHello message.
Now I want to use Java's SSL implementation to send exactly the same ClientHello. The following code:
System.setProperty("https.protocols", "TLSv1"); System.setProperty("javax.net.debug", "ssl:handshake"); SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault(); SSLSocket socket = (SSLSocket) factory.createSocket("ips-server", 443); socket.setEnabledProtocols(new String[] {"TLSv1"}); socket.setEnabledCipherSuites(new String[] {"SSL_RSA_WITH_RC4_128_MD5"}); socket.startHandshake();
produces the following handshake:
Secure Sockets LayerTLSv1.2 Record Layer: Handshake Protocol: Client Hello Content Type: Handshake (22) Version: TLS 1.0 (0x0301) Length: 52 Handshake Protocol: Client Hello Handshake Type: Client Hello (1) Length: 48 Version: TLS 1.0 (0x0301) Random Session ID Length: 0 Cipher Suites Length: 2 Cipher Suites (1 suite) Compression Methods Length: 1 Compression Methods (1 method) Extensions Length: 5 Extension: renegotiation_info Type: renegotiation_info (0xff01) Length: 1 Renegotiation Info extension
This causes the server to send back the following packet:
TLSv1.2 Record Layer: Alert (Level: Fatal, Description: Handshake Failure)
Is it possible to make Java not send the "extension" part of the packet?