8

The Oracle documentation seems to indicate Java 8 sends SNI automatically and by default. Wireshark indicates otherwise. I'm a PowerShell sysadmin, not a Java developer, so it's near-certain I'm overlooking something.

When used with the proper trust keystore, the following code returns status 200 from all SSL websites that don't require SNI. It also returns well when connecting to the default SSL website of a multiple-host Apache server. When asked to connect to a non-default site, though, it fails for cert name not matching the site name, since it connects to the default site.

import java.util.*;
import java.net.*;
import javax.net.ssl.*;
import java.io.*;

public class testJavaHttpConn {
    public static void main(String[] args) throws Exception {
        String strUrl = args[0];
        System.out.println("Trying to connect to " + strUrl);
        try {
            URL url = new URL(strUrl);
            HttpsURLConnection urlConn = (HttpsURLConnection) url.openConnection();
            System.out.println("Connecting");
            urlConn.connect();
            System.out.println("Done");
            System.out.println("Response " + urlConn.getResponseCode());
        } catch (IOException e) {
            System.err.println("Error creating HTTP connection");
            e.printStackTrace();
            throw e;
        }
    }
}

I've not set System.setProperty ("jsse.enableSNIExtension", "false"); and when I set -Djavax.net.debug=ssl it clearly shows the server name extension not being set.

I'm aware I can implement an SSLSocket and set the SSLParameter serverName, if I'm willing to dive down to the next deeper layer of abstraction, but I'd like to avoid that.

Edit: The code works as written above for Flo in the comments. It's failing for me with 1.8.0_72 on Linux 2.6.18-194.11.3.el5 and with 1.8.0_51 on Windows 7. The Windows installation is vanilla, while the Linux installation has updated the urandom value to securerandom.source=file:/dev/./urandom. I'm not sure how I can determine what about my installations is different from Flo's.

5
  • So you're looking for methods other than the ones documented here? Commented Feb 12, 2016 at 16:00
  • I'm limited by ignorance. The code snippets using SSLSocket assume the knowledge to build all the stuff preceding and following, and I lack that. I've not yet found an example showing how to perform the connect and retrieve using SSLSocket and convert the output into the same object HttpURLConnection returns. I've built all those objects per those snippets, but can't do anything with them once I have them. Given my ignorance it seemed wise to ask whether I am overlooking a simple property somewhere that causes HttpsURLConnection to send SNI. If the answer is no, then SSLSocket it is.
    – codepoke
    Commented Feb 12, 2016 at 16:12
  • 1
    I tested your code using "sni.velox.ch" and the debug says Extension server_name, server_name: [type=host_name (0), value=sni.velox.ch]. It results in status 200. With using System.setProperty ("jsse.enableSNIExtension", "false") I get an error (as expected) and the extention is missing in debug. System: Ubuntu Linux, Java 1.8.0_72 (but also worked with 1.7.0_95). Sadly, I don't have a solution for you.
    – flo
    Commented Feb 12, 2016 at 17:00
  • Ah. Thank you, Flo! I do not see Extension_server_name when I run the code. So, there's something different between your 1.8.0_72 and mine, and if mine were right it really should be sending SNI. The only file I tweak in my installation is ${JDK_HOME}/jre/lib/security/java.security. I wonder if something in there could be hampering me.
    – codepoke
    Commented Feb 12, 2016 at 18:03
  • Whoa. Actually, I notice flo's alias was fully qualified, and I was using a shortname alias (intranet, you know?). I tried the FQDN, and the server name is sent. Now I'm erroring with certificate naming issues, all of which should resolve beautifully! Call off the hunt. When I'm 100% sure this is the resolution, I'll post an answer below.
    – codepoke
    Commented Feb 12, 2016 at 21:50

1 Answer 1

6

HttpsURLConnection does send SNI by default and out of the box iff the URL to which it's connecting is a fully qualified name. It doesn't send the SNI for local intranet shortname aliases.

Extension server_name, server_name: [type=host_name (0), value=site.company.com]

(For the record, I also needed to deploy a new certificate with SANs for the short and fully qualified names, but that was trivial.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.