up vote 0 down vote favorite
share [g+] share [fb]

I'm running jdk 1.6.0_24 in a custom linux OS based system. I've received questions from a client's auditor around the version of SSL is on GUI and what is driving it in the backend. I know that we're using JSSE within JDK to do SSL, but I can't seem to find JSSE version. Any ideas?

Thanks!

link|improve this question
100% accept rate
feedback

2 Answers

up vote 1 down vote

As it is in the JDK/JRE itself I would answer 1.6.0_24. But if the auditor asks for the SSL and TLS version, it is SSL 3.0 and TLS 1.0.

More documentation can be found at Oracle.

link|improve this answer
Yeah, I got the SSL/TLS version by using openssl s_client -connect (etc)... but the auditor wants to know what's running it on the server. Thanks though – sandroid Aug 10 '11 at 18:27
feedback
up vote 0 down vote accepted

Actually can answer this one myself... dunno why I didn't think of it sooner. Ran strings against /path/to/jdkstuff/blah/jsse.jar and got this at the top:

META-INF/PK
META-INF/MANIFEST.MFManifest-Version: 1.0
Implementation-Vendor: Sun Microsystems, Inc.
Implementation-Version: 1.6
Implementation-Vendor-Id: com.sun
Specification-Vendor: Sun Microsystems, Inc.
Created-By: 1.6.0_18-ea (Sun Microsystems Inc.)
Specification-Version: 1.6

Looks like it'll be enough for audit purposes :)

link|improve this answer
Aaaand. It tells you 1.6 which is not more that the JDK/JRE version. – mailq Aug 10 '11 at 18:46
Indeed, but when I told them the JDK version they weren't happy enough, showing them this was satisfactory... probably looking out for the possibility I'd be using a newer JDK with a drop in JSSE.jar that was older? Who knows, point is, I did what I could, and they're satisfied now :) – sandroid Aug 10 '11 at 18:47
Funny auditors. It's always fun to work with them. :) – mailq Aug 10 '11 at 18:50
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.