Question

I want to initiate an SSL connection with a remote server using SSLv2. I am using Java. I tried to get the supported protocols in my socket using:

String[] suppProtocols=socket.getSupportedProtocols();
System.out.println("The protocols supported for this socket are: 
"+Arrays.toString(suppProtocols));

and I got this in the output:

[SSLv2Hello, SSLv3, TLSv1, TLSv1.1, TLSv1.2]

Now, I read that Java does not support SSLv2 and SSLv2Hello only sends hello message using SSLv2. I can’t grasp what does this means? Isn’t the same as if the client support SSLv2? How can I make SSL connection using SSLv2.

Answer 1

SSLv3 and TLSv1.x offer a way to wrap their Client Hello message in an SSLv2 Client Hello, as described in the TLS specification: Backward compatibility with SSL. SSLv3 and TLS 1 and above have a more consistent mechanism to negotiate the version. As the TLS spec says:

The ability to send Version 2.0 client hello messages will be
phased out with all due haste. Implementors SHOULD make every
effort to move forward as quickly as possible. Version 3.0
provides better mechanisms for moving to newer versions.

The Sun/Oracle JRE or OpenJDK doesn’t support SSLv2. Wrapping an SSLv3+ message into an SSLv2 message was just for backward compatibility. It is now disabled by default for clients in Java 7. From a server point of view, it can at least accept other SSLv3+ clients that wrap their Client Hello message in an SSLv2 message this way, whether they support SSLv2 or not.

You’ll find more details about Java support (including other implementations) in this question.

Generally speaking, SSLv2 is considered insecure: you simply shouldn’t use it. The general trend is to move away from SSLv3 towards TLS 1.0 or higher, not to go backwards.