3

I'm running jdk 1.6.0_24 in a custom linux OS based system. I've received questions from a client's auditor around the version of SSL is on GUI and what is driving it in the backend. I know that we're using JSSE within JDK to do SSL, but I can't seem to find JSSE version. Any ideas?

Thanks!

Improve this question

2 Answers 2

Reset to default
2

Actually can answer this one myself... dunno why I didn't think of it sooner. Ran strings against /path/to/jdkstuff/blah/jsse.jar and got this at the top:

META-INF/PK
META-INF/MANIFEST.MFManifest-Version: 1.0
Implementation-Vendor: Sun Microsystems, Inc.
Implementation-Version: 1.6
Implementation-Vendor-Id: com.sun
Specification-Vendor: Sun Microsystems, Inc.
Created-By: 1.6.0_18-ea (Sun Microsystems Inc.)
Specification-Version: 1.6

Looks like it'll be enough for audit purposes :)

Improve this answer
3
  • Aaaand. It tells you 1.6 which is not more that the JDK/JRE version.
    – mailq
    Aug 10, 2011 at 18:46
  • Indeed, but when I told them the JDK version they weren't happy enough, showing them this was satisfactory... probably looking out for the possibility I'd be using a newer JDK with a drop in JSSE.jar that was older? Who knows, point is, I did what I could, and they're satisfied now :)
    – sandroid
    Aug 10, 2011 at 18:47
  • Funny auditors. It's always fun to work with them. :)
    – mailq
    Aug 10, 2011 at 18:50
1

As it is in the JDK/JRE itself I would answer 1.6.0_24. But if the auditor asks for the SSL and TLS version, it is SSL 3.0 and TLS 1.0.

More documentation can be found at Oracle.

Improve this answer
1
  • Yeah, I got the SSL/TLS version by using openssl s_client -connect (etc)... but the auditor wants to know what's running it on the server. Thanks though
    – sandroid
    Aug 10, 2011 at 18:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.