Java TLS Client Debugging

Luke Hebert

- One minute read - 157 words

When a Java application sits between you and a TLS endpoint, diagnosing handshake failures can be frustrating. The application may not expose a way to enable low-level SSL debugging, leaving you to guess whether the issue is a certificate problem, a protocol mismatch, or something else entirely. This guide walks through a small, standalone TLS client you can compile and run to inspect the handshake directly, using only the JVM’s built-in trust store.

Compile the code below after setting the tlsVersion and httpsUrl parameters, then execute it with the appropriate debug flags. Keep in mind, this tool is designed to work with the built-in CACerts and publicly signed certificates only.

Debug Levels

  1. No debug
  2. Handshake debug
  3. Full TLS debug
# javac attachments/tlsclient.java
# java TLSClient
# java -Djavax.net.debug=ssl,handshake TLSClient
# java -Djavax.net.debug=all TLSClient

Source Code

V 0.1 JDK 11 and below (remove _1 for use)

📎 Download tlsclient-1.java

V 0.2 JDK 11+

📎 Download tlsclient.java