Groups > comp.lang.java.programmer > #34900

Re: enableSNIExtension

Path	csiph.com!aioe.org!.POSTED!not-for-mail
From	Arne Vajhøj <arne@vajhoej.dk>
Newsgroups	comp.lang.java.programmer
Subject	Re: enableSNIExtension
Date	Thu, 14 Jul 2016 22:18:40 -0400
Organization	Aioe.org NNTP Server
Lines	33
Message-ID	<nm9h5u$1ccc$1@gioia.aioe.org> (permalink)
References	<9pebobhdrt11bm3nebh31hcm3s30oo18t4@4ax.com>
NNTP-Posting-Host	7SK6yTFfqwlIPNBLl3l7Qg.user.gioia.aioe.org
Mime-Version	1.0
Content-Type	text/plain; charset=windows-1252; format=flowed
Content-Transfer-Encoding	7bit
X-Complaints-To	abuse@aioe.org
User-Agent	Mozilla/5.0 (Windows NT 6.1; WOW64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0
X-Notice	Filtered by postfilter v. 0.8.2
Xref	csiph.com comp.lang.java.programmer:34900

Show key headers only | View raw

On 7/12/2016 11:57 PM, Roedy Green wrote:
>  System.setProperty( "jsse.enableSNIExtension", "false" );
>
> Oracle erred in making this a system property.
>
> It is something you configure on a site by site basis.  This really
> should be a method of  HttpURLConnection.
>
> Consider what happen when you have many threads each reading from SSL
> sites.
>
> The only thing I can think of to bypass this error is to bundle the
> sites that use SNI and do not, and process them in two separate lumps.
>
> Surely there is some way to probe a site to see if it uses SNI.  If
> so, this system property could be deprecated.

Most sites should support it by now, so maybe you can just run with
default (true).

I believe that many think that Java should just ignore the server
response from non-SNI servers when enabled, because then there would
never be a reason to disable it.

But if you have a case where you have both SNI servers and non-SNI
servers, then 2 JVM's seems like the easy solution.

The hard solution must be to play around with SSLSocketFactory
and SSLSocket and do some magic to make it a per connection thing.
I have not tried that.

Arne

Back to comp.lang.java.programmer | Previous | Next — Previous in thread | Find similar | Unroll thread

Thread

enableSNIExtension Roedy Green <inquiry@mindprod.com> - 2016-07-12 20:57 -0700
  Re: enableSNIExtension Silvio <silvio@internet.com> - 2016-07-14 00:48 +0200
  Re: enableSNIExtension Arne Vajhøj <arne@vajhoej.dk> - 2016-07-14 22:18 -0400

csiph-web