com.google.api.client.http.javanet

Interface SslSocketConfigurator

public interface SslSocketConfigurator

A callback interface allowing users to programmatically configure active SSLSocket parameters (e.g., named groups, cipher suites, application protocols) before the TLS handshake starts.

Exposing this hook allows users to customize advanced TLS capabilities that are not configurable via standard JVM system properties, or require custom security provider APIs (e.g., Conscrypt or BouncyCastle). Typical use cases include:

• Enabling Post-Quantum Cryptography (PQC) hybrid curves (e.g., X25519MLKEM768).
• Configuring Application-Layer Protocol Negotiation (ALPN) for HTTP/2.
• Restricting cipher suites or protocol versions dynamically based on environment.

JDK Version and Provider Compatibility Matrix for PQC

• JDK 27+: PQC algorithms are supported natively by default. No custom configurator or security provider is required.
• JDK 20-26: Callers can configure named groups natively using standard JRE JSSE APIs (via SSLParameters.setNamedGroups(String[])), as shown in the JDK 20+ example below.
• JDK 8-19: The standard JRE does not expose APIs to set named groups. Callers must register a custom security provider (like Conscrypt JNI or BouncyCastle) and configure sockets using the provider-specific APIs demonstrated in the examples below.

Conscrypt Configuration Example

{@code
 builder.setSslSocketConfigurator(new SslSocketConfigurator() {

Since:

2.1.2

Method Summary

Modifier and Type	Method and Description
void	configure(SSLSocket sslSocket) Configures the active TLS socket parameters before the handshake starts.

Method Detail

configure

void configure(SSLSocket sslSocket)

Configures the active TLS socket parameters before the handshake starts.

Parameters:

sslSocket - the newly created SSLSocket connection