Search code examples
javasslsquidtls1.2

How to read SNI extension in Java?

I want to find host name from TLS Client Hello Message. I want to find host name before java does complete handshake for transparent ssl proxy.

Is there any way to find SNI extension value without writing whole ssl handshake logic ?

Is Java supports ssl handshake with initial memory buffer ? My Idea is:

  1. Read TLS client hello message, parse it and find SNI value
  2. Call sslSocket.startHandshake(initialBuffer) Initial buffer will contain TLS client hello packet data. So Java can do handshake.

Second Idea is to use SSLEngine class. But it seems a lot more implementation than requirement. I assume SSLEngine is used most of async in case which I don't require it.

Third idea is to implement complete TLS protocol.

Which idea is better ?

Solution

  • Both SSLSocket and SSLEngine lack (quite inexplicable) proper SNI support for server connections.

    I came across the same problem myself and ended up writing a library: TLS Channel. It does not only that, it is actually a complete abstraction for SSLEngine, exposed as a ByteChannel. Regarding SNI, the library does the parsing of the first bytes before creating the SSLEngine. The user can then supply a function to the server channel, to select SSLContexts depending on the received domain name.