URL and HTTPS

We are sending XML documents between two servers via SSL over HTTP (aka "HTTPS"), but not using SOAP. I tried to find out the best way to "reuse" our SSL sessions to avoid the dreaded handshake, but noone could tell me exactly how to do it. I ended up experimenting with the URL class and found that when I reused the same URL object for subsequent requests, the SSL session was used "auto-magically".
That was enough evidence for me to go ahead with implementation and decided that a sateless session bean was an ideal candidate as my "connection manager". Can anyone validate that this is true? Can anyone tell me why reusing the same URL object uses the same SSL session?
Thanks,
Chris

Hi
I have been trying the same thing. I have posted a question before in this forum with subject "How to keep HTTPS connection live", but no one answered.
you are saying reusing the same URL object keeps the session. Can you please explain in detail. Right now I am doing like this
<code>
URL url = new URL( "https://www.verisign.com");
URLConnection urlc = url.openConnection();
urlc.setRequestProperty("Content-Type", "text/xml");
urlc.setDoOutput(true);
urlc.setDoInput(true);
OutputStream out = urlc.getOutputStream();
InputStream in = urlc.getInputStream();
</code>
Every time I need the i and out objects I am calling the above code. It is taking much time for handshaking every time. To reduce the handshaking time. If I reuse the URL object, still I need to call url.openConnection() method every time I need to connect to the server. Am I right? Correct me please.
Thanks
Prasad Charasala

[This message has been edited by Prasad Charasala (edited December 11, 2001).]

The key for me was to turn on the SSL debugging using the VM option: "-Djavax.net.debug=ssl"
This prints out the entire SSL communication process. Most of it is just encrypted content, but at the beginning of each connection it says whether it is using a new connection or reusing the same session. The test below connects to Verisign and IBM and uses a Hashtable to store the URL objects. While this is not a robust connection pool, it illustrates the point that by reusing a URL object, the SSL session is reused.
Hope that helps.
Chris
import java.net.*;
import java.io.*;
import java.util.*;
public class SSLConnection
{
Hashtable urls = new Hashtable();
boolean debugInfo = true;
boolean SSLDebug = true;
public static void main(String args[])
{
// Need to add the Security Provider to use SSL
java.security.Security.addProvider( new com.sun.net.ssl.internal.ssl.Provider());

SSLConnection SSL = new SSLConnection();

SSL.goToSecureSites();
}

/**
* Stores references to requested address and reuses URL objects
*/
public URLConnection getSSLConnection(String address)
throws MalformedURLException, IOException
{
URL requestAddr = null;
if (urls.containsKey(address))
{
requestAddr = (URL) urls.get(address);
}
else
{
requestAddr = new URL(address);
urls.put(address, requestAddr);
}

return requestAddr.openConnection();

}

public void goToSecureSites()
{
debug("\n\nSSLConnection.goToSecureSites(): Begin");

if (this.SSLDebug)
{
System.setProperty("javax.net.debug", "ssl");
}

try
{
debug("Connecting to Verisign");
URLConnection conn = this.getSSLConnection("https://www.verisign.com");
printContent(conn);
debug("Finished Connecting to Verisign");

System.out.print("Pausing 5 seconds:...");
Thread.currentThread().sleep(1000);
System.out.print("1...");
Thread.currentThread().sleep(1000);
System.out.print("2...");
Thread.currentThread().sleep(1000);
System.out.print("3...");
Thread.currentThread().sleep(1000);
System.out.print("4...");
Thread.currentThread().sleep(1000);
System.out.print("5...Resuming\n");

debug("Connecting to IBM");
conn = this.getSSLConnection("https://www.ibm.com");
printContent(conn);
debug("Finished Connecting to IBM");

System.out.print("Pausing 3 seconds:...");
Thread.currentThread().sleep(1000);
System.out.print("1...");
Thread.currentThread().sleep(1000);
System.out.print("2...");
Thread.currentThread().sleep(1000);
System.out.print("3...");
Thread.currentThread().sleep(1000);
System.out.print("4...");
Thread.currentThread().sleep(1000);
System.out.print("5...Resuming\n");

debug("Connecting to Verisign (again)");
conn = this.getSSLConnection("https://www.verisign.com");
printContent(conn);
debug("Finished Connecting to Verisign (again)");

System.out.print("Pausing 5 seconds:...");
Thread.currentThread().sleep(1000);
System.out.print("1...");
Thread.currentThread().sleep(1000);
System.out.print("2...");
Thread.currentThread().sleep(1000);
System.out.print("3...");
Thread.currentThread().sleep(1000);
System.out.print("4...");
Thread.currentThread().sleep(1000);
System.out.print("5...Resuming\n");

debug("Connecting to IBM (again)");
conn = this.getSSLConnection("https://www.ibm.com");
printContent(conn);
debug("Finished Connecting to IBM (again)");

}
catch(Exception e)
{
System.out.print(e);
System.exit(1);
}

}

public void printContent(URLConnection conn)
{
try
{
conn.setDoOutput(false);
conn.setDoInput(true);

System.out.println(conn.getRequestProperty("Content-Type"));

// Get response data.
BufferedReader input = new BufferedReader (
new InputStreamReader(conn.getInputStream ()));
String str = null;
while (null != ( (str = input.readLine()) ) )
{
System.out.println (str);
}
input.close ();

}
catch(Exception e)
{
System.out.println(e);
System.exit(1);
}
}

public void debug(String stmt)
{
System.out.println(new Date() + ": " + stmt);
}
}

Thanks Chris,
I will use pool of URL objects as you did and use them to get HTTPSConnection.
Thanks