topic Re: SDK & TLS1.2 in Integration and Testing

SDK & TLS1.2

sa — Mon, 22 May 2017 08:48:39 GMT

Hello,

The suggested fix didn't solve the TLS issue

Environment information:
Google App Engine ( GAE )
Java 7

We set the default TLS to 1.2 ( following documentation https://blogs.oracle.com/java-platform-group/diagnosing-tls,-ssl,-and-https ) but still we get the same issue, we passed this by only updating/fixing your SDK to support TLS 1.2 , and here is some detail:

Extend DefaultHttpClient so we can set the enabled SSL protocols in method createClientConnectionManager.java and set the enabled SSL protocols
http://docs.oracle.com/javase/7/docs/api/javax/net/ssl/SSLSocket.html#setEnabledProtocols(java.lang.String[])
Extend HttpCallTask.java so we can use the extended DefaultHttpClient
Extend HttpUtility.java so we can use the extended HttpCallTask

Please advice,

Re: SDK & TLS1.2

NexusSoftware — Mon, 22 May 2017 12:20:23 GMT

You could

try {
SSLContext ctx = SSLContext.getInstance("TLSv1.2");
ctx.init(null, null, null);
SSLContext.setDefault(ctx);
} catch (Exception e) {
System.out.println(e.getMessage());
}

final SSLContext ctx = SSLContext.getInstance("TLSv1.2");
ctx.init(null,null, new java.security.SecureRandom());
final SSLSocketFactory socketFactory = ctx.getSocketFactory();
HttpsURLConnection.setDefaultSSLSocketFactory(socketFactory);

Re: SDK & TLS1.2

sa — Thu, 25 May 2017 08:07:21 GMT

That would be a solution if we don't use GAE..
With GAE the methods setFactory() and setDefaultSSLContext() are not allowed.

Re: SDK & TLS1.2

NexusSoftware — Thu, 25 May 2017 08:47:01 GMT

On GAE you could try something like:

exec "${RUN_JAVA}" "${SCRIPT_NAME}" \
    -Ddeployment.security.TLSv1.1=false -Ddeployment.security.TLSv1.2=true -ea -cp "${JAR_FILE}" \
    com.google.appengine.tools.KickStart \
    com.google.appengine.tools.development.DevAppServerMain "$@"

Re: SDK & TLS1.2

sa — Thu, 25 May 2017 09:27:25 GMT

You are basically saying to set the system properties

Ddeployment.security.TLSv1.2 to true

And

deployment.security.TLSv1.1 to false

That doesn't fix the issue unfortunately..