[HTTPCLIENT-1784] TLS Client Hello is always TLS 1.0 (0x0301) under IBM Java

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 4.5.2
• Component/s: HttpClient (classic)
• Labels: tls
• Environment: IBM Java, many versions including latest Java 8.
• Assignee: Unassigned
• Reporter: Bruce Adams
• Created: 12/Oct/16 00:28
• Updated: 17/Oct/16 16:01
• Resolved: 17/Oct/16 15:06

Description

A simple client program fails to connect to any site that requires TLSv1.2. The attached ApacheGet.java program, run with org.apache.httpcomponents/httpclient version 4.5.2 and given the URL https://www.sandbox.paypal.com fails with:

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

when run on the latest released IBM Java, pxa6480sr3fp12-20160919_01(SR3 FP12) (available in a Docker image ibmcom/ibmjava:8-sdk). The same run is successful on a recent Oracle Java 8.

The similar, simple, Get.java program that uses the built-in Java libraries instead of Apache HttpClient works fine on both IBM Java and Oracle Java.