AppletTalk.com

dan · Guest

I've written a Java applet which is attempting to communicate over TLS
with a server written in C and using OpenSSL. When a handshake is
attempted the client successfully sends its ClientHello message, and
the server sends its ServerHello message containing its Hello, its
certificate, the certificate request, and the Hello Done. My applet
throws an exception upon receiving those messages:

javax.net.ssl.SSLException: Unsupported record version Unknown-11.0

Here's the client code:

--- begin code ---

ssl_context = SSLContext.getInstance("TLSv1");
/* FakeTM is a temp implementation of X509TrustManager that accepts any
certificate
* as valid */
ssl_context.init(null, new TrustManager[] {new FakeTM()}, null);
ssl_socket_factory = (SSLSocketFactory)ssl_context.getSocketFactory();
/* create a new SSLSocket from the existing cleartext socket */
ssl_socket = (SSLSocket)ssl_socket_factory.createSocket(socket,
targetHost, serverPort, false);
ssl_socket.setEnabledProtocols(new String[] {new String("TLSv1")});
ssl_socket.setEnabledCipherSuites(ssl_socket_factory.getSupportedCipherSuites());

--- end code ---

and here's what gets written to the Java console:

--- begin console output ---

Thread-12, handling exception: javax.net.ssl.SSLException: Unsupported
record version Unknown-11.0
Thread-12, SEND TLSv1 ALERT: fatal, description = unexpected_message
Thread-12, WRITE: TLSv1 Alert, length = 2
Thread-12, called closeSocket()
IO thread shutting down due to an IOException: Connection has been
shutdown: javax.net.ssl.SSLException: Unsupported record version
Unknown-11.0

--- end console output ---

0x11 does appear in the ServerHello message; according to the RFC (and
my Ethereal output), it specifies a handshake type of 'Certificate'.
When I set the SSL_VERIFY_NONE property on my server using
SSL_CTX_set_verify(), the server doesn't send a certificate request
message anymore (which is correct), but now the exception thrown by
Java reads "Unsupported record version Unknown-13.0". 0x13 is the
"Server Hello Done" message.

Is Java expecting only the server Hello and Certificate messages for
some reason, and then throwing an exception if anything else is read?
Can I change this behavior somehow, either in the client or the server?

thanks in advance for any help.