Java Tip 96: Use HTTPS in your Java client code

Find out how to use the HTTPS protocol with the standard URL class

By Matt Towers, JavaWorld.com, 06/16/00

From the client perspective, however, the simplicity of the S at the end of the familiar HTTP is deceiving. The browser is actually doing a considerable amount of behind-the-scenes work to ensure that no one has tampered with or monitored the information that you requested. As it turns out, the algorithm to do the encryption for HTTPS is patented by RSA Security (for at least a few more months). The use of that algorithm has been licensed by browser manufacturers but was not licensed by Sun Microsystems to be included in the standard Java URL class implementation. As a result, if you attempt to construct a URL object with a string specifying HTTPS as the protocol, a MalformedURLException will be thrown.

Fortunately, to accommodate that constraint, the Java specification provides for the ability to select an alternate stream handler for the URL class. However, the technique required to implement that is different, depending on the virtual machine (VM) you use. For Microsoft's JDK 1.1-compatible VM, JView, Microsoft has licensed the algorithm and provided an HTTPS stream handler as part of its wininet package. Sun, on the other hand, has recently released the Java Secure Sockets Extension (JSSE) for JDK 1.2-compatible VMs, in which Sun has also licensed and provided an HTTPS stream handler. This article will demonstrate how to implement the use of an HTTPS-enabled stream handler, using the JSSE and Microsoft's wininet package.

JDK 1.2-compatible virtual machines

The technique for using JDK 1.2-compatible VMs relies primarily on the Java Secure Sockets Extension (JSSE) 1.0.1. Before that technique will work, you must install the JSSE and add it to the class path of the client VM in question.

After you have installed the JSSE, you must set a system property and add a new security provider to the Security class object. There are a variety of ways to do both of these things, but for the purposes of this article, the programmatic method is shown:

   System.setProperty("java.protocol.handler.pkgs",
        "com.sun.net.ssl.internal.www.protocol");
   Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());

After making the previous two method calls, the MalformedURLException will no longer be thrown by calling the following code: