SSLParameters (Java Platform SE 8 )
Keywords: javax.net.ssl.SSLParameters class
Date: 2026-08-19

compact1, compact2, compact3
javax.net.ssl

## Class SSLParameters

- java.lang.Object
- - javax.net.ssl.SSLParameters

-     public class SSLParameters
      extends Object

  Encapsulates parameters for an SSL/TLS connection. The parameters are the list of ciphersuites to be accepted in an SSL/TLS handshake, the list of protocols to be allowed, the endpoint identification algorithm during SSL/TLS handshaking, the Server Name Indication (SNI), the algorithm constraints and whether SSL/TLS servers should request or require client authentication, etc.

  SSLParameters can be created via the constructors in this class. Objects can also be obtained using the `getSSLParameters()` methods in `SSLSocket` and `SSLServerSocket` and `SSLEngine` or the `getDefaultSSLParameters()` and `getSupportedSSLParameters()` methods in `SSLContext`.

  SSLParameters can be applied to a connection via the methods `SSLSocket.setSSLParameters()` and `SSLServerSocket.setSSLParameters()` and `SSLEngine.setSSLParameters()`.

  For example:

  >          SSLParameters p = sslSocket.getSSLParameters();
  >          p.setProtocols(new String[] { "TLSv1.2" });
  >          p.setCipherSuites(
  >              new String[] { "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", ... });
  >          p.setApplicationProtocols(new String[] {"h2", "http/1.1"});
  >          sslSocket.setSSLParameters(p);

  *
  Since:
    1.6
  See Also:
    `SSLSocket`, `SSLEngine`, `SSLContext`

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `SSLParameters()` Constructs SSLParameters.
    `SSLParameters(String[] cipherSuites)` Constructs SSLParameters from the specified array of ciphersuites.
    `SSLParameters(String[] cipherSuites, String[] protocols)` Constructs SSLParameters from the specified array of ciphersuites and protocols.

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `AlgorithmConstraints` | `getAlgorithmConstraints()` Returns the cryptographic algorithm constraints.
    `String[]` | `getApplicationProtocols()` Returns a prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols.
    `String[]` | `getCipherSuites()` Returns a copy of the array of ciphersuites or null if none have been set.
    `String` | `getEndpointIdentificationAlgorithm()` Gets the endpoint identification algorithm.
    `boolean` | `getNeedClientAuth()` Returns whether client authentication should be required.
    `String[]` | `getProtocols()` Returns a copy of the array of protocols or null if none have been set.
    `List<SNIServerName>` | `getServerNames()` Returns a `List` containing all `SNIServerName`s of the Server Name Indication (SNI) parameter, or null if none has been set.
    `Collection<SNIMatcher>` | `getSNIMatchers()` Returns a `Collection` containing all `SNIMatcher`s of the Server Name Indication (SNI) parameter, or null if none has been set.
    `boolean` | `getUseCipherSuitesOrder()` Returns whether the local cipher suites preference should be honored.
    `boolean` | `getWantClientAuth()` Returns whether client authentication should be requested.
    `void` | `setAlgorithmConstraints(AlgorithmConstraints constraints)` Sets the cryptographic algorithm constraints, which will be used in addition to any configured by the runtime environment.
    `void` | `setApplicationProtocols(String[] protocols)` Sets the prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols.
    `void` | `setCipherSuites(String[] cipherSuites)` Sets the array of ciphersuites.
    `void` | `setEndpointIdentificationAlgorithm(String algorithm)` Sets the endpoint identification algorithm.
    `void` | `setNeedClientAuth(boolean needClientAuth)` Sets whether client authentication should be required.
    `void` | `setProtocols(String[] protocols)` Sets the array of protocols.
    `void` | `setServerNames(List<SNIServerName> serverNames)` Sets the desired `SNIServerName`s of the Server Name Indication (SNI) parameter.
    `void` | `setSNIMatchers(Collection<SNIMatcher> matchers)` Sets the `SNIMatcher`s of the Server Name Indication (SNI) parameter.
    `void` | `setUseCipherSuitesOrder(boolean honorOrder)` Sets whether the local cipher suites preference should be honored.
    `void` | `setWantClientAuth(boolean wantClientAuth)` Sets whether client authentication should be requested.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### SSLParameters

          public SSLParameters()

      Constructs SSLParameters.

      The values of cipherSuites, protocols, cryptographic algorithm constraints, endpoint identification algorithm, server names and server name matchers are set to `null`, useCipherSuitesOrder, wantClientAuth and needClientAuth are set to `false`.

    - #### SSLParameters

          public SSLParameters(String[] cipherSuites)

      Constructs SSLParameters from the specified array of ciphersuites.

      Calling this constructor is equivalent to calling the no-args constructor followed by `setCipherSuites(cipherSuites);`.

      Parameters:
        `cipherSuites` - the array of ciphersuites (or null)

    - #### SSLParameters

          public SSLParameters(String[] cipherSuites,
                               String[] protocols)

      Constructs SSLParameters from the specified array of ciphersuites and protocols.

      Calling this constructor is equivalent to calling the no-args constructor followed by `setCipherSuites(cipherSuites); setProtocols(protocols);`.

      Parameters:
        `cipherSuites` - the array of ciphersuites (or null)
        `protocols` - the array of protocols (or null)

  - ### Method Detail

    - #### getCipherSuites

          public String[] getCipherSuites()

      Returns a copy of the array of ciphersuites or null if none have been set.
      Returns:
        a copy of the array of ciphersuites or null if none have been set.

    - #### setCipherSuites

          public void setCipherSuites(String[] cipherSuites)

      Sets the array of ciphersuites.
      Parameters:
        `cipherSuites` - the array of ciphersuites (or null)

    - #### getProtocols

          public String[] getProtocols()

      Returns a copy of the array of protocols or null if none have been set.
      Returns:
        a copy of the array of protocols or null if none have been set.

    - #### setProtocols

          public void setProtocols(String[] protocols)

      Sets the array of protocols.
      Parameters:
        `protocols` - the array of protocols (or null)

    - #### getWantClientAuth

          public boolean getWantClientAuth()

      Returns whether client authentication should be requested.
      Returns:
        whether client authentication should be requested.

    - #### setWantClientAuth

          public void setWantClientAuth(boolean wantClientAuth)

      Sets whether client authentication should be requested. Calling this method clears the `needClientAuth` flag.
      Parameters:
        `wantClientAuth` - whether client authentication should be requested

    - #### getNeedClientAuth

          public boolean getNeedClientAuth()

      Returns whether client authentication should be required.
      Returns:
        whether client authentication should be required.

    - #### setNeedClientAuth

          public void setNeedClientAuth(boolean needClientAuth)

      Sets whether client authentication should be required. Calling this method clears the `wantClientAuth` flag.
      Parameters:
        `needClientAuth` - whether client authentication should be required

    - #### getAlgorithmConstraints

          public AlgorithmConstraints getAlgorithmConstraints()

      Returns the cryptographic algorithm constraints.
      Returns:
        the cryptographic algorithm constraints, or null if the constraints have not been set
      Since:
        1.7
      See Also:
        `setAlgorithmConstraints(AlgorithmConstraints)`

    - #### setAlgorithmConstraints

          public void setAlgorithmConstraints(AlgorithmConstraints constraints)

      Sets the cryptographic algorithm constraints, which will be used in addition to any configured by the runtime environment.

      If the `constraints` parameter is non-null, every cryptographic algorithm, key and algorithm parameters used in the SSL/TLS handshake must be permitted by the constraints.

      Parameters:
        `constraints` - the algorithm constraints (or null)
      Since:
        1.7

    - #### getEndpointIdentificationAlgorithm

          public String getEndpointIdentificationAlgorithm()

      Gets the endpoint identification algorithm.
      Returns:
        the endpoint identification algorithm, or null if none has been set.
      Since:
        1.7
      See Also:
        `X509ExtendedTrustManager`, `setEndpointIdentificationAlgorithm(String)`

    - #### setEndpointIdentificationAlgorithm

          public void setEndpointIdentificationAlgorithm(String algorithm)

      Sets the endpoint identification algorithm.

      If the `algorithm` parameter is non-null or non-empty, the endpoint identification/verification procedures must be handled during SSL/TLS handshaking. This is to prevent man-in-the-middle attacks.

      Parameters:
        `algorithm` - The standard string name of the endpoint identification algorithm (or null). See Appendix A in the Java Cryptography Architecture API Specification & Reference for information about standard algorithm names.
      Since:
        1.7
      See Also:
        `X509ExtendedTrustManager`

    - #### setServerNames

          public final void setServerNames(List<SNIServerName> serverNames)

      Sets the desired `SNIServerName`s of the Server Name Indication (SNI) parameter.

      This method is only useful to `SSLSocket`s or `SSLEngine`s operating in client mode.

      Note that the `serverNames` list is cloned to protect against subsequent modification.

      Parameters:
        `serverNames` - the list of desired `SNIServerName`s (or null)
      Throws:
        `NullPointerException` - if the `serverNames` contains `null` element
        `IllegalArgumentException` - if the `serverNames` contains more than one name of the same name type
      Since:
        1.8
      See Also:
        `SNIServerName`, `getServerNames()`

    - #### getServerNames

          public final List<SNIServerName> getServerNames()

      Returns a `List` containing all `SNIServerName`s of the Server Name Indication (SNI) parameter, or null if none has been set.

      This method is only useful to `SSLSocket`s or `SSLEngine`s operating in client mode.

      For SSL/TLS connections, the underlying SSL/TLS provider may specify a default value for a certain server name type. In client mode, it is recommended that, by default, providers should include the server name indication whenever the server can be located by a supported server name type.

      It is recommended that providers initialize default Server Name Indications when creating `SSLSocket`/`SSLEngine`s. In the following examples, the server name could be represented by an instance of `SNIHostName` which has been initialized with the hostname "www.example.com" and type `StandardConstants.SNI_HOST_NAME`.

               Socket socket =
                   sslSocketFactory.createSocket("www.example.com", 443);

      or

               SSLEngine engine =
                   sslContext.createSSLEngine("www.example.com", 443);

      Returns:
        null or an immutable list of non-null `SNIServerName`s
      Since:
        1.8
      See Also:
        `List`, `setServerNames(List)`

    - #### setSNIMatchers

          public final void setSNIMatchers(Collection<SNIMatcher> matchers)

      Sets the `SNIMatcher`s of the Server Name Indication (SNI) parameter.

      This method is only useful to `SSLSocket`s or `SSLEngine`s operating in server mode.

      Note that the `matchers` collection is cloned to protect against subsequent modification.

      Parameters:
        `matchers` - the collection of `SNIMatcher`s (or null)
      Throws:
        `NullPointerException` - if the `matchers` contains `null` element
        `IllegalArgumentException` - if the `matchers` contains more than one name of the same name type
      Since:
        1.8
      See Also:
        `Collection`, `SNIMatcher`, `getSNIMatchers()`

    - #### getSNIMatchers

          public final Collection<SNIMatcher> getSNIMatchers()

      Returns a `Collection` containing all `SNIMatcher`s of the Server Name Indication (SNI) parameter, or null if none has been set.

      This method is only useful to `SSLSocket`s or `SSLEngine`s operating in server mode.

      For better interoperability, providers generally will not define default matchers so that by default servers will ignore the SNI extension and continue the handshake.

      Returns:
        null or an immutable collection of non-null `SNIMatcher`s
      Since:
        1.8
      See Also:
        `SNIMatcher`, `setSNIMatchers(Collection)`

    - #### setUseCipherSuitesOrder

          public final void setUseCipherSuitesOrder(boolean honorOrder)

      Sets whether the local cipher suites preference should be honored.
      Parameters:
        `honorOrder` - whether local cipher suites order in `#getCipherSuites` should be honored during SSL/TLS handshaking.
      Since:
        1.8
      See Also:
        `getUseCipherSuitesOrder()`

    - #### getUseCipherSuitesOrder

          public final boolean getUseCipherSuitesOrder()

      Returns whether the local cipher suites preference should be honored.
      Returns:
        whether local cipher suites order in `#getCipherSuites` should be honored during SSL/TLS handshaking.
      Since:
        1.8
      See Also:
        `setUseCipherSuitesOrder(boolean)`

    - #### getApplicationProtocols

          public String[] getApplicationProtocols()

      Returns a prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols.

      The array could be empty (zero-length), in which case protocol indications will not be used.

      This method will return a new array each time it is invoked.

      API Note:
        This method is defined in Java SE 8 Maintenance Release 3.
      Returns:
        a non-null, possibly zero-length array of application protocol `String`s. The array is ordered based on protocol preference, with `protocols[0]` being the most preferred.
      Since:
        8
      See Also:
        `setApplicationProtocols(java.lang.String[])`

    - #### setApplicationProtocols

          public void setApplicationProtocols(String[] protocols)

      Sets the prioritized array of application-layer protocol names that can be negotiated over the SSL/TLS/DTLS protocols.

      If application-layer protocols are supported by the underlying SSL/TLS implementation, this method configures which values can be negotiated by protocols such as RFC 7301 , the Application Layer Protocol Negotiation (ALPN).

      If this end of the connection is expected to offer application protocol values, all protocols configured by this method will be sent to the peer.

      If this end of the connection is expected to select the application protocol value, the `protocols` configured by this method are compared with those sent by the peer. The first matched value becomes the negotiated value. If none of the `protocols` were actually requested by the peer, the underlying protocol will determine what action to take. (For example, ALPN will send a `"no_application_protocol"` alert and terminate the connection.)

      API Note:
        This method is defined in Java SE 8 Maintenance Release 3.
      Implementation Requirements:
        This method will make a copy of the `protocols` array.
      Parameters:
        `protocols` - an ordered array of application protocols, with `protocols[0]` being the most preferred. If the array is empty (zero-length), protocol indications will not be used.
      Throws:
        `IllegalArgumentException` - if protocols is null, or if any element in a non-empty array is null or an empty (zero-length) string
      Since:
        8
      See Also:
        `getApplicationProtocols()`

Submit a bug or feature
For further API reference and developer documentation, see Java SE Documentation. That documentation contains more detailed, developer-targeted descriptions, with conceptual overviews, definitions of terms, workarounds, and working code examples.
Copyright © 1993, 2026, Oracle and/or its affiliates. All rights reserved. Use is subject to license terms. Also see the documentation redistribution policy.