Most visited

Recently visited

Added in API level 1

SSLSocket

public abstract class SSLSocket
extends Socket

java.lang.Object
   ↳ java.net.Socket
     ↳ javax.net.ssl.SSLSocket


This class extends Sockets and provides secure socket using protocols such as the "Secure Sockets Layer" (SSL) or IETF "Transport Layer Security" (TLS) protocols.

Such sockets are normal stream sockets, but they add a layer of security protections over the underlying network transport protocol, such as TCP. Those protections include:

These kinds of protection are specified by a "cipher suite", which is a combination of cryptographic algorithms used by a given SSL connection. During the negotiation process, the two endpoints must agree on a ciphersuite that is available in both environments. If there is no such suite in common, no SSL connection can be established, and no data can be exchanged.

The cipher suite used is established by a negotiation process called "handshaking". The goal of this process is to create or rejoin a "session", which may protect many connections over time. After handshaking has completed, you can access session attributes by using the getSession method. The initial handshake on this connection can be initiated in one of three ways:

If handshaking fails for any reason, the SSLSocket is closed, and no futher communications can be done.

There are two groups of cipher suites which you will need to know about when managing cipher suites:

Implementation defaults require that only cipher suites which authenticate servers and provide confidentiality be enabled by default. Only if both sides explicitly agree to unauthenticated and/or non-private (unencrypted) communications will such a ciphersuite be selected.

When SSLSockets are first created, no handshaking is done so that applications may first set their communication preferences: what cipher suites to use, whether the socket should be in client or server mode, etc. However, security is always provided by the time that application data is sent over the connection.

You may register to receive event notification of handshake completion. This involves the use of two additional classes. HandshakeCompletedEvent objects are passed to HandshakeCompletedListener instances, which are registered by users of this API. SSLSockets are created by SSLSocketFactorys, or by accepting a connection from a SSLServerSocket.

A SSL socket must choose to operate in the client or server mode. This will determine who begins the handshaking process, as well as which messages should be sent by each party. Each connection must have one client and one server, or handshaking will not progress properly. Once the initial handshaking has started, a socket can not switch between client and server modes, even when performing renegotiations.

Default configuration for different Android versions

SSLSocket instances obtained from default SSLSocketFactory, SSLServerSocketFactory, and SSLContext are configured as follows:

Protocols

Client socket:

Protocol Supported (API Levels) Enabled by default (API Levels)
SSLv3 1+ 1+
TLSv1 1+ 1+
TLSv1.1 16+ 20+
TLSv1.2 16+ 20+

Server socket:

Protocol Supported (API Levels) Enabled by default (API Levels)
SSLv3 1+ 1–22
TLSv1 1+ 1+
TLSv1.1 16+ 16+
TLSv1.2 16+ 16+

Cipher suites

Methods that operate with cipher suite names (for example, getSupportedCipherSuites, setEnabledCipherSuites) have used standard names for cipher suites since API Level 9, as listed in the table below. Prior to API Level 9, non-standard (OpenSSL) names had been used (see the table following this table).

Cipher suite Supported (API Levels) Enabled by default (API Levels)
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA 9–22 9–19
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA 9–22 9–19
SSL_DHE_DSS_WITH_DES_CBC_SHA 9–22 9–19
SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA 9–22 9–19
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA 9–22 9–19
SSL_DHE_RSA_WITH_DES_CBC_SHA 9–22 9–19
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA 9–22
SSL_DH_anon_EXPORT_WITH_RC4_40_MD5 9–22
SSL_DH_anon_WITH_3DES_EDE_CBC_SHA 9–22
SSL_DH_anon_WITH_DES_CBC_SHA 9–22
SSL_DH_anon_WITH_RC4_128_MD5 9–22
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA 9–22 9–19
SSL_RSA_EXPORT_WITH_RC4_40_MD5 9–22 9–19
SSL_RSA_WITH_3DES_EDE_CBC_SHA 9+ 9–19
SSL_RSA_WITH_DES_CBC_SHA 9–22 9–19
SSL_RSA_WITH_NULL_MD5 9–22
SSL_RSA_WITH_NULL_SHA 9–22
SSL_RSA_WITH_RC4_128_MD5 9+ 9–19
SSL_RSA_WITH_RC4_128_SHA 9+ 9–23
TLS_DHE_DSS_WITH_AES_128_CBC_SHA 9–22 9–22
TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 20–22
TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 20–22
TLS_DHE_DSS_WITH_AES_256_CBC_SHA 9–22 11–22
TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 20–22
TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 20–22
TLS_DHE_RSA_WITH_AES_128_CBC_SHA 9+ 9+
TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 20+
TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 20+ 20+
TLS_DHE_RSA_WITH_AES_256_CBC_SHA 9+ 11+
TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 20+
TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 20+ 20+
TLS_DH_anon_WITH_AES_128_CBC_SHA 9–22
TLS_DH_anon_WITH_AES_128_CBC_SHA256 20–22
TLS_DH_anon_WITH_AES_128_GCM_SHA256 20–22
TLS_DH_anon_WITH_AES_256_CBC_SHA 9–22
TLS_DH_anon_WITH_AES_256_CBC_SHA256 20–22
TLS_DH_anon_WITH_AES_256_GCM_SHA384 20–22
TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA 11–22 11–19
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA 11+ 11+
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 20+
TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 20+ 20+
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA 11+ 11+
TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 20+
TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 20+ 20+
TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256 24+ 24+
TLS_ECDHE_ECDSA_WITH_NULL_SHA 11–22
TLS_ECDHE_ECDSA_WITH_RC4_128_SHA 11+ 11–23
TLS_ECDHE_PSK_WITH_AES_128_CBC_SHA 21+ 21+
TLS_ECDHE_PSK_WITH_AES_256_CBC_SHA 21+ 21+
TLS_ECDHE_PSK_WITH_CHACHA20_POLY1305_SHA256 24+ 24+
TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA 11–22 11–19
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA 11+ 11+
TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 20+
TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 20+ 20+
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 11+ 11+
TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 20+
TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 20+ 20+
TLS_ECDHE_RSA_WITH_NULL_SHA 11–22
TLS_ECDHE_RSA_WITH_RC4_128_SHA 11+ 11–23
TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA 11–22 11–19
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA 11–22 11–19
TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 20–22
TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 20–22
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA 11–22 11–19
TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 20–22
TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 20–22
TLS_ECDH_ECDSA_WITH_NULL_SHA 11–22
TLS_ECDH_ECDSA_WITH_RC4_128_SHA 11–22 11–19
TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA 11–22 11–19
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA 11–22 11–19
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 20–22
TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 20–22
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 11–22 11–19
TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 20–22
TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 20–22
TLS_ECDH_RSA_WITH_NULL_SHA 11–22
TLS_ECDH_RSA_WITH_RC4_128_SHA 11–22 11–19
TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA 11–22
TLS_ECDH_anon_WITH_AES_128_CBC_SHA 11–22
TLS_ECDH_anon_WITH_AES_256_CBC_SHA 11–22
TLS_ECDH_anon_WITH_NULL_SHA 11–22
TLS_ECDH_anon_WITH_RC4_128_SHA 11–22
TLS_EMPTY_RENEGOTIATION_INFO_SCSV 11+ 11+
TLS_FALLBACK_SCSV 21+
TLS_PSK_WITH_3DES_EDE_CBC_SHA 21–22
TLS_PSK_WITH_AES_128_CBC_SHA 21+ 21+
TLS_PSK_WITH_AES_256_CBC_SHA 21+ 21+
TLS_PSK_WITH_RC4_128_SHA 21+
TLS_RSA_WITH_AES_128_CBC_SHA 9+ 9+
TLS_RSA_WITH_AES_128_CBC_SHA256 20+
TLS_RSA_WITH_AES_128_GCM_SHA256 20+ 20+
TLS_RSA_WITH_AES_256_CBC_SHA 9+ 11+
TLS_RSA_WITH_AES_256_CBC_SHA256 20+
TLS_RSA_WITH_AES_256_GCM_SHA384 20+ 20+
TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 24+ 24+
TLS_RSA_WITH_NULL_SHA256 20–22

NOTE: PSK cipher suites are enabled by default only if the SSLContext through which the socket was created has been initialized with a PSKKeyManager.

API Levels 1 to 8 use OpenSSL names for cipher suites. The table below lists these OpenSSL names and their corresponding standard names used in API Levels 9 and newer.

OpenSSL cipher suite Standard cipher suite Supported (API Levels) Enabled by default (API Levels)
AES128-SHA TLS_RSA_WITH_AES_128_CBC_SHA 1+ 1+
AES256-SHA TLS_RSA_WITH_AES_256_CBC_SHA 1+ 1–8, 11+
DES-CBC-MD5 SSL_CK_DES_64_CBC_WITH_MD5 1–8 1–8
DES-CBC-SHA SSL_RSA_WITH_DES_CBC_SHA 1–22 1–19
DES-CBC3-MD5 SSL_CK_DES_192_EDE3_CBC_WITH_MD5 1–8 1–8
DES-CBC3-SHA SSL_RSA_WITH_3DES_EDE_CBC_SHA 1+ 1–19
DHE-DSS-AES128-SHA TLS_DHE_DSS_WITH_AES_128_CBC_SHA 1–22 1–22
DHE-DSS-AES256-SHA TLS_DHE_DSS_WITH_AES_256_CBC_SHA 1–22 1–8, 11–22
DHE-RSA-AES128-SHA TLS_DHE_RSA_WITH_AES_128_CBC_SHA 1+ 1+
DHE-RSA-AES256-SHA TLS_DHE_RSA_WITH_AES_256_CBC_SHA 1+ 1–8, 11+
EDH-DSS-DES-CBC-SHA SSL_DHE_DSS_WITH_DES_CBC_SHA 1–22 1–19
EDH-DSS-DES-CBC3-SHA SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA 1–22 1–19
EDH-RSA-DES-CBC-SHA SSL_DHE_RSA_WITH_DES_CBC_SHA 1–22 1–19
EDH-RSA-DES-CBC3-SHA SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA 1–22 1–19
EXP-DES-CBC-SHA SSL_RSA_EXPORT_WITH_DES40_CBC_SHA 1–22 1–19
EXP-EDH-DSS-DES-CBC-SHA SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA 1–22 1–19
EXP-EDH-RSA-DES-CBC-SHA SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA 1–22 1–19
EXP-RC2-CBC-MD5 SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 1–8 1–8
EXP-RC4-MD5 SSL_RSA_EXPORT_WITH_RC4_40_MD5 1–22 1–19
RC2-CBC-MD5 SSL_CK_RC2_128_CBC_WITH_MD5 1–8 1–8
RC4-MD5 SSL_RSA_WITH_RC4_128_MD5 1+ 1–19
RC4-SHA SSL_RSA_WITH_RC4_128_SHA 1+ 1–23

See also:

Summary

Protected constructors

SSLSocket()

Used only by subclasses.

SSLSocket(String host, int port)

Used only by subclasses.

SSLSocket(InetAddress address, int port)

Used only by subclasses.

SSLSocket(String host, int port, InetAddress clientAddress, int clientPort)

Used only by subclasses.

SSLSocket(InetAddress address, int port, InetAddress clientAddress, int clientPort)

Used only by subclasses.

Public methods

abstract void addHandshakeCompletedListener(HandshakeCompletedListener listener)

Registers an event listener to receive notifications that an SSL handshake has completed on this connection.

abstract boolean getEnableSessionCreation()

Returns true if new SSL sessions may be established by this socket.

abstract String[] getEnabledCipherSuites()

Returns the names of the SSL cipher suites which are currently enabled for use on this connection.

abstract String[] getEnabledProtocols()

Returns the names of the protocol versions which are currently enabled for use on this connection.

SSLSession getHandshakeSession()

Returns the SSLSession being constructed during a SSL/TLS handshake.

abstract boolean getNeedClientAuth()

Returns true if the socket will require client authentication.

SSLParameters getSSLParameters()

Returns the SSLParameters in effect for this SSLSocket.

abstract SSLSession getSession()

Returns the SSL Session in use by this connection.

abstract String[] getSupportedCipherSuites()

Returns the names of the cipher suites which could be enabled for use on this connection.

abstract String[] getSupportedProtocols()

Returns the names of the protocols which could be enabled for use on an SSL connection.

abstract boolean getUseClientMode()

Returns true if the socket is set to use client mode when handshaking.

abstract boolean getWantClientAuth()

Returns true if the socket will request client authentication.

abstract void removeHandshakeCompletedListener(HandshakeCompletedListener listener)

Removes a previously registered handshake completion listener.

abstract void setEnableSessionCreation(boolean flag)

Controls whether new SSL sessions may be established by this socket.

abstract void setEnabledCipherSuites(String[] suites)

Sets the cipher suites enabled for use on this connection.

abstract void setEnabledProtocols(String[] protocols)

Sets the protocol versions enabled for use on this connection.

abstract void setNeedClientAuth(boolean need)

Configures the socket to require client authentication.

void setSSLParameters(SSLParameters params)

Applies SSLParameters to this socket.

abstract void setUseClientMode(boolean mode)

Configures the socket to use client (or server) mode when handshaking.

abstract void setWantClientAuth(boolean want)

Configures the socket to request client authentication.

abstract void startHandshake()

Starts an SSL handshake on this connection.

Inherited methods

From class java.net.Socket
From class java.lang.Object
From interface java.io.Closeable
From interface java.lang.AutoCloseable

Protected constructors

SSLSocket

Added in API level 1
SSLSocket ()

Used only by subclasses. Constructs an uninitialized, unconnected TCP socket.

SSLSocket

Added in API level 1
SSLSocket (String host, 
                int port)

Used only by subclasses. Constructs a TCP connection to a named host at a specified port. This acts as the SSL client.

If there is a security manager, its checkConnect method is called with the host address and port as its arguments. This could result in a SecurityException.

Parameters
host String: name of the host with which to connect, or null for the loopback address.
port int: number of the server's port
Throws
IOException if an I/O error occurs when creating the socket
SecurityException if a security manager exists and its checkConnect method doesn't allow the operation.
UnknownHostException if the host is not known
IllegalArgumentException if the port parameter is outside the specified range of valid port values, which is between 0 and 65535, inclusive.

See also:

SSLSocket

Added in API level 1
SSLSocket (InetAddress address, 
                int port)

Used only by subclasses. Constructs a TCP connection to a server at a specified address and port. This acts as the SSL client.

If there is a security manager, its checkConnect method is called with the host address and port as its arguments. This could result in a SecurityException.

Parameters
address InetAddress: the server's host
port int: its port
Throws
IOException if an I/O error occurs when creating the socket
SecurityException if a security manager exists and its checkConnect method doesn't allow the operation.
IllegalArgumentException if the port parameter is outside the specified range of valid port values, which is between 0 and 65535, inclusive.
NullPointerException if address is null.

See also:

SSLSocket

Added in API level 1
SSLSocket (String host, 
                int port, 
                InetAddress clientAddress, 
                int clientPort)

Used only by subclasses. Constructs an SSL connection to a named host at a specified port, binding the client side of the connection a given address and port. This acts as the SSL client.

If there is a security manager, its checkConnect method is called with the host address and port as its arguments. This could result in a SecurityException.

Parameters
host String: name of the host with which to connect, or null for the loopback address.
port int: number of the server's port
clientAddress InetAddress: the client's address the socket is bound to, or null for the anyLocal address.
clientPort int: the client's port the socket is bound to, or zero for a system selected free port.
Throws
IOException if an I/O error occurs when creating the socket
SecurityException if a security manager exists and its checkConnect method doesn't allow the operation.
UnknownHostException if the host is not known
IllegalArgumentException if the port parameter or clientPort parameter is outside the specified range of valid port values, which is between 0 and 65535, inclusive.

See also:

SSLSocket

Added in API level 1
SSLSocket (InetAddress address, 
                int port, 
                InetAddress clientAddress, 
                int clientPort)

Used only by subclasses. Constructs an SSL connection to a server at a specified address and TCP port, binding the client side of the connection a given address and port. This acts as the SSL client.

If there is a security manager, its checkConnect method is called with the host address and port as its arguments. This could result in a SecurityException.

Parameters
address InetAddress: the server's host
port int: its port
clientAddress InetAddress: the client's address the socket is bound to, or null for the anyLocal address.
clientPort int: the client's port the socket is bound to, or zero for a system selected free port.
Throws
IOException if an I/O error occurs when creating the socket
SecurityException if a security manager exists and its checkConnect method doesn't allow the operation.
IllegalArgumentException if the port parameter or clientPort parameter is outside the specified range of valid port values, which is between 0 and 65535, inclusive.
NullPointerException if address is null.

See also:

Public methods

addHandshakeCompletedListener

Added in API level 1
void addHandshakeCompletedListener (HandshakeCompletedListener listener)

Registers an event listener to receive notifications that an SSL handshake has completed on this connection.

Parameters
listener HandshakeCompletedListener: the HandShake Completed event listener
Throws
IllegalArgumentException if the argument is null.

See also:

getEnableSessionCreation

Added in API level 1
boolean getEnableSessionCreation ()

Returns true if new SSL sessions may be established by this socket.

Returns
boolean true indicates that sessions may be created; this is the default. false indicates that an existing session must be resumed

See also:

getEnabledCipherSuites

Added in API level 1
String[] getEnabledCipherSuites ()

Returns the names of the SSL cipher suites which are currently enabled for use on this connection. When an SSLSocket is first created, all enabled cipher suites support a minimum quality of service. Thus, in some environments this value might be empty.

Even if a suite has been enabled, it might never be used. (For example, the peer does not support it, the requisite certificates (and private keys) for the suite are not available, or an anonymous suite is enabled but authentication is required.

Returns
String[] an array of cipher suite names

See also:

getEnabledProtocols

Added in API level 1
String[] getEnabledProtocols ()

Returns the names of the protocol versions which are currently enabled for use on this connection.

Returns
String[] an array of protocols

See also:

getHandshakeSession

Added in API level 24
SSLSession getHandshakeSession ()

Returns the SSLSession being constructed during a SSL/TLS handshake.

TLS protocols may negotiate parameters that are needed when using an instance of this class, but before the SSLSession has been completely initialized and made available via getSession. For example, the list of valid signature algorithms may restrict the type of certificates that can used during TrustManager decisions, or the maximum TLS fragment packet sizes can be resized to better support the network environment.

This method provides early access to the SSLSession being constructed. Depending on how far the handshake has progressed, some data may not yet be available for use. For example, if a remote server will be sending a Certificate chain, but that chain has yet not been processed, the getPeerCertificates method of SSLSession will throw a SSLPeerUnverifiedException. Once that chain has been processed, getPeerCertificates will return the proper value.

Unlike getSession(), this method does not initiate the initial handshake and does not block until handshaking is complete.

Returns
SSLSession null if this instance is not currently handshaking, or if the current handshake has not progressed far enough to create a basic SSLSession. Otherwise, this method returns the SSLSession currently being negotiated.
Throws
UnsupportedOperationException if the underlying provider does not implement the operation.

See also:

getNeedClientAuth

Added in API level 1
boolean getNeedClientAuth ()

Returns true if the socket will require client authentication. This option is only useful to sockets in the server mode.

Returns
boolean true if client authentication is required, or false if no client authentication is desired.

See also:

getSSLParameters

Added in API level 9
SSLParameters getSSLParameters ()

Returns the SSLParameters in effect for this SSLSocket. The ciphersuites and protocols of the returned SSLParameters are always non-null.

Returns
SSLParameters the SSLParameters in effect for this SSLSocket.

getSession

Added in API level 1
SSLSession getSession ()

Returns the SSL Session in use by this connection. These can be long lived, and frequently correspond to an entire login session for some user. The session specifies a particular cipher suite which is being actively used by all connections in that session, as well as the identities of the session's client and server.

This method will initiate the initial handshake if necessary and then block until the handshake has been established.

If an error occurs during the initial handshake, this method returns an invalid session object which reports an invalid cipher suite of "SSL_NULL_WITH_NULL_NULL".

Returns
SSLSession the SSLSession

getSupportedCipherSuites

Added in API level 1
String[] getSupportedCipherSuites ()

Returns the names of the cipher suites which could be enabled for use on this connection. Normally, only a subset of these will actually be enabled by default, since this list may include cipher suites which do not meet quality of service requirements for those defaults. Such cipher suites might be useful in specialized applications.

Returns
String[] an array of cipher suite names

See also:

getSupportedProtocols

Added in API level 1
String[] getSupportedProtocols ()

Returns the names of the protocols which could be enabled for use on an SSL connection.

Returns
String[] an array of protocols supported

getUseClientMode

Added in API level 1
boolean getUseClientMode ()

Returns true if the socket is set to use client mode when handshaking.

Returns
boolean true if the socket should do handshaking in "client" mode

See also:

getWantClientAuth

Added in API level 1
boolean getWantClientAuth ()

Returns true if the socket will request client authentication. This option is only useful for sockets in the server mode.

Returns
boolean true if client authentication is requested, or false if no client authentication is desired.

See also:

removeHandshakeCompletedListener

Added in API level 1
void removeHandshakeCompletedListener (HandshakeCompletedListener listener)

Removes a previously registered handshake completion listener.

Parameters
listener HandshakeCompletedListener: the HandShake Completed event listener
Throws
IllegalArgumentException if the listener is not registered, or the argument is null.

See also:

setEnableSessionCreation

Added in API level 1
void setEnableSessionCreation (boolean flag)

Controls whether new SSL sessions may be established by this socket. If session creations are not allowed, and there are no existing sessions to resume, there will be no successful handshaking.

Parameters
flag boolean: true indicates that sessions may be created; this is the default. false indicates that an existing session must be resumed

See also:

setEnabledCipherSuites

Added in API level 1
void setEnabledCipherSuites (String[] suites)

Sets the cipher suites enabled for use on this connection.

Each cipher suite in the suites parameter must have been listed by getSupportedCipherSuites(), or the method will fail. Following a successful call to this method, only suites listed in the suites parameter are enabled for use.

See getEnabledCipherSuites() for more information on why a specific ciphersuite may never be used on a connection.

Parameters
suites String: Names of all the cipher suites to enable
Throws
IllegalArgumentException when one or more of the ciphers named by the parameter is not supported, or when the parameter is null.

See also:

setEnabledProtocols

Added in API level 1
void setEnabledProtocols (String[] protocols)

Sets the protocol versions enabled for use on this connection.

The protocols must have been listed by getSupportedProtocols() as being supported. Following a successful call to this method, only protocols listed in the protocols parameter are enabled for use.

Parameters
protocols String: Names of all the protocols to enable.
Throws
IllegalArgumentException when one or more of the protocols named by the parameter is not supported or when the protocols parameter is null.

See also:

setNeedClientAuth

Added in API level 1
void setNeedClientAuth (boolean need)

Configures the socket to require client authentication. This option is only useful for sockets in the server mode.

A socket's client authentication setting is one of the following:

  • client authentication required
  • client authentication requested
  • no client authentication desired

Unlike setWantClientAuth(boolean), if this option is set and the client chooses not to provide authentication information about itself, the negotiations will stop and the connection will be dropped.

Calling this method overrides any previous setting made by this method or setWantClientAuth(boolean).

Parameters
need boolean: set to true if client authentication is required, or false if no client authentication is desired.

See also:

setSSLParameters

Added in API level 9
void setSSLParameters (SSLParameters params)

Applies SSLParameters to this socket.

This means:

  • if params.getCipherSuites() is non-null, setEnabledCipherSuites() is called with that value
  • if params.getProtocols() is non-null, setEnabledProtocols() is called with that value
  • if params.getNeedClientAuth() or params.getWantClientAuth() return true, setNeedClientAuth(true) and setWantClientAuth(true) are called, respectively; otherwise setWantClientAuth(false) is called.

Parameters
params SSLParameters: the parameters
Throws
IllegalArgumentException if the setEnabledCipherSuites() or the setEnabledProtocols() call fails

setUseClientMode

Added in API level 1
void setUseClientMode (boolean mode)

Configures the socket to use client (or server) mode when handshaking.

This method must be called before any handshaking occurs. Once handshaking has begun, the mode can not be reset for the life of this socket.

Servers normally authenticate themselves, and clients are not required to do so.

Parameters
mode boolean: true if the socket should start its handshaking in "client" mode
Throws
IllegalArgumentException if a mode change is attempted after the initial handshake has begun.

See also:

setWantClientAuth

Added in API level 1
void setWantClientAuth (boolean want)

Configures the socket to request client authentication. This option is only useful for sockets in the server mode.

A socket's client authentication setting is one of the following:

  • client authentication required
  • client authentication requested
  • no client authentication desired

Unlike setNeedClientAuth(boolean), if this option is set and the client chooses not to provide authentication information about itself, the negotiations will continue.

Calling this method overrides any previous setting made by this method or setNeedClientAuth(boolean).

Parameters
want boolean: set to true if client authentication is requested, or false if no client authentication is desired.

See also:

startHandshake

Added in API level 1
void startHandshake ()

Starts an SSL handshake on this connection. Common reasons include a need to use new encryption keys, to change cipher suites, or to initiate a new session. To force complete reauthentication, the current session could be invalidated before starting this handshake.

If data has already been sent on the connection, it continues to flow during this handshake. When the handshake completes, this will be signaled with an event. This method is synchronous for the initial handshake on a connection and returns when the negotiated handshake is complete. Some protocols may not support multiple handshakes on an existing socket and may throw an IOException.

Throws
IOException on a network level error

See also:

Hooray!