SSL/TLS protocol version in Java EE
12:57 22 Nov 2016

Is there any way in Java EE to know what SSL/TLS protocol is being used for a secure connection?

Ideally I want the application to use TLS/1.2 for everything, but I know some browsers (IE 9 say) by default won't support that. If I configure my environment to only allow TLS/1.2 then IE 9 will go "ohh this website is down", if you then click help, advance it actually tells you "oh this might be that the settings in IE disable sensible encryption, you and do this to enable sensible encryption". (I am paraphrasing slightly).

Anyway the response is a cold, "website down", which is not true, it's just IE does not wish to support sensible protocols. My preference would be to change the configuration to allow weaker protocols like TLS/1.0, my application can then detect that a weak protocol is being used and on every page there can be some sort of warning "you know this is not secure, click here for more information", ie a helpful message that confirms that the website is working, just their browser is insecure. I can't see any attributes that form part of HttpServletRequest that might give me this information or any other method that answers the question.

Any thoughts?

java internet-explorer ssl servlets