如何确认及配置HttpClient 4.5.1支持TLSv1.1/1.2并禁用TLSv1.0

Great questions—let’s break this down clearly for you as someone new to this area:

1. Does your current code support TLSv1.1 and TLSv1.2? #

Yes, but it depends on your JVM version and default settings:

• Your code uses the default SSLContext (created via SSLContextBuilder().build()), which inherits the JVM’s default enabled TLS protocols.
• Java 7: TLSv1 and TLSv1.1 are enabled by default; TLSv1.2 is supported but may not be enabled unless you explicitly turn it on (via code or JVM properties).
• Java 8+: TLSv1, TLSv1.1, and TLSv1.2 are all enabled by default (TLSv1.3 is added in newer Java versions too).

That said, relying on defaults isn’t safe if your client is moving to TLSv1.2-only—you’ll want to explicitly enforce the allowed protocols.

2. Where is the default protocol determined? #

The default enabled protocols come from two key places:

• JVM System Properties: The JVM uses properties like jdk.tls.client.protocols (for client connections) and https.protocols to define default allowed protocols. If these are set, they override the JVM’s built-in defaults.
• SSLContext Configuration: When you create an SSLContext without specifying protocols, it uses the JVM’s default set. Your current code doesn’t explicitly set protocols, so it’s using whatever the JVM provides.

Apache HttpClient’s SSLConnectionSocketFactory will use the protocols enabled in the SSLContext unless you explicitly specify otherwise.

3. How to modify your code to enable TLSv1.1/TLSv1.2 and disable TLSv1.0? #

The safest approach is to explicitly define allowed protocols in your SSLConnectionSocketFactory—this ensures your HttpClient only uses the protocols you want, regardless of JVM defaults. Here’s the updated code:

// Create SSLContext with your existing trust manager logic
SSLContext sslContext = SSLContextBuilder.create()
        .loadTrustMaterial(null, getTrustAllCertsManager())
        .build();

// Define the protocols you want to allow (TLSv1.1 and TLSv1.2 only)
String[] allowedProtocols = {"TLSv1.1", "TLSv1.2"};

// Build the SSL socket factory with explicit protocols
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
        sslContext,
        allowedProtocols,
        null, // Use default cipher suites (specify custom ones if needed)
        SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

// Initialize your HttpClient with the configured socket factory
CloseableHttpClient httpClient = HttpClients.custom()
        .setSSLSocketFactory(sslsf)
        .build();

Critical Notes: #

• Avoid ALLOW_ALL_HOSTNAME_VERIFIER: This disables hostname validation, a major security risk for production. Use the default verifier (omit the parameter or use DefaultHostnameVerifier()) to ensure the server’s certificate matches its hostname.
• JVM Compatibility: Ensure you’re running Java 7 or newer—Java 6 doesn’t support TLSv1.2 natively, so you’ll need to upgrade if you’re on that version.
• Alternative: JVM Properties: If you want to affect all SSL connections in your JVM (not just this HttpClient), set these system properties at startup:

  -Djdk.tls.client.protocols=TLSv1.1,TLSv1.2
  

  Modifying the code is better for isolating this configuration to your specific HttpClient instance.

内容的提问来源于stack exchange，提问作者Bhaskar