SSL Handshake Details exposure without using javax.net.debug

Question

Is there a way to capture SSL/TLS handshaking details within java, specifically the CertificateRequest information sent over a secondary handshake as in IIS 7.5?

Details: I am working on a SSL/TLS scanner that works on mutually authenticated systems and need to capture the hint lists provided by the server, if any.

Thanks! mrwmd1

Answer 1

So, I used the output of javax.net.debug redirected to a String object and parsed it looking for the relevant messages. I looked for a couple of days and found no way of exposing the handshake messages in java through any way other than the debug. Too bad... Unfortunately, this is not thread safe and the debug output gets all written over if you run two or more clients concurrently.