[FIXED] SSL Protocal used by Browser to Send Request to Server

Issue

I have a Servlet to which a client (Browser) can make a request. I want to know which SSL Protocol version is used for this request like, SSL / TLS / TLS 1.1 / TLS 1.2 in my servlet. Can anyone guide me through this.

I am using Java 8, Tomcat 8.5.9.

Thanks in advance

Solution

According to the source code (search for populateSslRequestAttributes if that link doesn't take you to the right place), Tomcat stores this information in the request attributes javax.servlet.request.cipher_suite and org.apache.tomcat.util.net.secure_protocol_version. So you should be able to just do:

public void doGet(HttpServletRequest request,
                  HttpServletResponse response) {
    String cipherSuite = request.getAttribute("javax.servlet.request.cipher_suite");
    String protocolVersion = request.getAttribute("org.apache.tomcat.util.net.secure_protocol_version");
...
}

Realize that some of this has to do with the way you have Tomcat configured. For example, I regularly place Apache in front of Tomcat and have a non-SSL connection from Apache to Tomcat. Tomcat would not be able to give you the information you need in that case.

Answered By - stdunbar
Answer Checked By - Cary Denson (JavaFixing Admin)