# Try to run old app with TLSv1.0 only against TLSv1.1+ only server

**URL:** https://discourse.mitmproxy.org/t/try-to-run-old-app-with-tlsv1-0-only-against-tlsv1-1-only-server/903
**Category:** help
**Created:** [March 8, 2018, 8:31pm UTC](https://discourse.mitmproxy.org/t/try-to-run-old-app-with-tlsv1-0-only-against-tlsv1-1-only-server/903 "2018-03-08T20:31:54Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![vguna](https://avatars.discourse-cdn.com/v4/letter/v/e9a140/32.png) [@vguna](https://discourse.mitmproxy.org/u/vguna)
#### Post date: [March 8, 2018, 8:31pm UTC](https://discourse.mitmproxy.org/t/try-to-run-old-app-with-tlsv1-0-only-against-tlsv1-1-only-server/903/1 "2018-03-08T20:31:54Z")

</div>

Hi.

I’m running a very old JDK5 based client which is using HttpsUrlConnection to connect to a 3rd party service using TLSv1 (which is the only supported TLS version in JDK5). Recently the 3rd party service upgraded to TLSv1.1+ only. Since I can’t ugrade the client to JDK7 or newer (libraries aren’t compatible), my hope is, that mitmproxy can help out here.

In my dreams, I simply set mitmproxy as a https proxy using

-Dhttps.proxyHost=mymitmproxyhost -Dhttps.proxyPort=8443

in the JVM. Then the client connects via https to its origin 3rd party service like [https://3rdpartyservice.com/bla](https://3rdpartyservice.com/bla). The TLSv1 connection then terminates @ mitmproxy and invokes the 3rd party service with whatever TLS version is required there. Then returning the result via mitmproxy and the TLSv1 connection back to the client. Is this possible in general? Of course I have to add the mitmproxy certs to the java keystore in the first place.

I tried it using mitmproxy -p 8443. But that ends up with:

javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?

Taking a look at the log reveals:

0000: 48 54 54 50 2F HTTP/  
main, handling exception: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?  
main, SEND TLSv1 ALERT: fatal, description = unexpected\_message  
main, WRITE: TLSv1 Alert, length = 2  
[Raw write]: length = 7  
0000: 15 03 01 00 02 02 0A …

It seems that “HTTP/” is returned without a version?! Also If I try the same e.g. via curl/wget I get

OpenSSL: error:140770FC:SSL routines:SSL23\_GET\_SERVER\_HELLO:unknown protocol

also s similar error (my guess is “unknown protocol” means it can’t recognized “HTTP/”?).  
Maybe I’m missing something here?

Any help is appreciated!

---

<div class="post-metadata">

### Author: ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)
#### Post date: [March 14, 2018, 11:10pm UTC](https://discourse.mitmproxy.org/t/try-to-run-old-app-with-tlsv1-0-only-against-tlsv1-1-only-server/903/2 "2018-03-14T23:10:06Z")

</div>

I remember we talked on Slack about this - is this fixed?