1a6bd5629d5f — Quintillus tip 2 years ago 
First forays into the Bouncy Castle.

 - Compatible with JDK 1.6.
 - Included dependencies
 - Registered the BouncyCastle JSSE (Java Secure Sockets Exention) provider.  As I understand it, it's kind of like the ImageIO Service Provider Interface situation where providers can be registered.
 - De-registered the build-in Sun provider.
 - Added the JCE (Java Cryptography Extensions) dependency in the Gemini Client, so it can use advanced cryptography.

So far it's failing on "no usable cipher suites enabled".  I'm not really sure why, as when I look at this list of enabled ones, it has a bunch of the commonly-used ones, e.g. AES 256 with Galois Counter Mode.  Are they enabled but not usable somehow?
patch browse 
2 files changed, 42 insertions(+), 2 deletions(-)

M pom.xml
M src/main/java/com/ajtjp/geminiclient/GeminiClient.java

M pom.xml +8 -1
@@ 3,11 3,18 @@ 
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.ajtjp</groupId>
     <artifactId>GeminiClient</artifactId>
-    <version>1.0-SNAPSHOT</version>
+    <version>0.5.1</version>
     <packaging>jar</packaging>
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <maven.compiler.source>1.5</maven.compiler.source>
         <maven.compiler.target>1.5</maven.compiler.target>
     </properties>
+    <dependencies>
+        <dependency>
+            <groupId>org.bouncycastle</groupId>
+            <artifactId>bctls-jdk15on</artifactId>
+            <version>1.66</version>
+        </dependency>
+    </dependencies>
 </project>
  No newline at end of file

          
M src/main/java/com/ajtjp/geminiclient/GeminiClient.java +34 -1
@@ 8,17 8,24 @@ import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.net.Socket;
+import java.security.KeyStore;
+import java.security.Provider;
+import java.security.Security;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
 import java.util.List;
 import javax.net.SocketFactory;
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.HttpsURLConnection;
+import javax.net.ssl.KeyManagerFactory;
 import javax.net.ssl.SSLContext;
 import javax.net.ssl.SSLSession;
+import javax.net.ssl.SSLSocket;
 import javax.net.ssl.SSLSocketFactory;
 import javax.net.ssl.TrustManager;
+import javax.net.ssl.TrustManagerFactory;
 import javax.net.ssl.X509TrustManager;
+import org.bouncycastle.jsse.provider.BouncyCastleJsseProvider;
 
 /**
  *

          
@@ 40,6 47,11 @@ public class GeminiClient {
         Socket s = basicSocketFactory.createSocket(host, port);
         s = sslSocketFactory.createSocket(s, host, port, true);
         
+        String[] ciphers = ((SSLSocket)s).getEnabledCipherSuites();
+        for (String str : ciphers) {
+            ;
+        }
+        
         OutputStream os = s.getOutputStream();
         os.write((url + "\r\n").getBytes());
         os.flush();

          
@@ 178,8 190,29 @@ public class GeminiClient {
                }
             };
 
-            SSLContext sc = SSLContext.getInstance("TLSv1.2");
+//            SSLContext sc = SSLContext.getInstance("TLSv1.2");
+
+            Provider[] providers = Security.getProviders();
+            Security.removeProvider("SunJCE");
+            
+            Security.addProvider(new BouncyCastleJsseProvider());
+            providers = Security.getProviders();
+            
+            SSLContext sc = SSLContext.getInstance("TLSv1.2", new BouncyCastleJsseProvider());
+            
+//            TrustManagerFactory trustMgrFact = TrustManagerFactory.getInstance(
+//                                                              "PKIX", "BCJSSE");
+//            trustMgrFact.init(KeyStore.getInstance(KeyStore.getDefaultType()));
+            
+            //Could use trustMgrFact.getTrustManagers() instead of trustAllCerts...
+            
+//            KeyManagerFactory keyMgrFact = KeyManagerFactory.getInstance("PKIX", "BCJSSE");
+//            keyMgrFact.init(KeyStore.getInstance(KeyStore.getDefaultType()), new char[0]);
+//            sc.init(keyMgrFact.getKeyManagers(), trustAllCerts, new java.security.SecureRandom());
+            
+            
             sc.init(null, trustAllCerts, new java.security.SecureRandom());
+            
             HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
             
             //adj also set it here