Java Question

Understand Set http protocols in JAVA

I've been setting the protocols allowed for http requests:

System.setProperty(“https.protocols”, “TLSv1,TLSv1.1,TLSv1.2”);


This work fine, But i don't understand what will happen if in my server I don't have supported some of those protocols, by example ,What happen if I doesn't have installed TLSv1.1?? The process will fail? or will use another TLS version that are allowed?

Answer

Yes there is a fallback procedure. The client contacts your server advertising the TLS version it would like to use in the initial ClientHello message.

If your server cannot support the client's preferred version then it will respond in its ServerHello message with the version it would prefer to use.

If the client agrees then the handshake continues. If the client cannot agree to your server's suggested version then it will respond with an alert and terminate the connection.

It's all documented in Appendix E of RFC5246.