title: Why does Java's SSLSocket send a version 2 client hello?
body: <p>The <code>SSLSocket.getEnabledProtocols()</code> method returns the following:  <code>[SSLv2Hello, SSLv3, TLSv1]</code>.  And indeed, when I call <code>connect()</code> and I have SSL debugging turned on, I see that a v2 client hello is used:</p>
  
  <pre><code>main, WRITE: TLSv1 Handshake, length = 81
  main, WRITE: SSLv2 client hello message, length = 110
  </code></pre>
  
  <p>But I have found two (admittedly old) references that say JSSE does <strong>not</strong> support SSL version 2:</p>
  
  <p>From <a href="http://books.google.com/books?id=l6f1jTB_XCYC&amp;pg=PA154&amp;lpg=PA154&amp;dq=java+sslv2&amp;source=bl&amp;ots=8zgmXGl4eG&amp;sig=w6hip2-HGlkbo4WeZy734ZRgqvk&amp;hl=en&amp;ei=fC8uTernJ8fEswahx8D7Bw&amp;sa=X&amp;oi=book_result&amp;ct=result&amp;resnum=9&amp;ved=0CEoQ6AEwCDge#v=onepage&amp;q=java%20sslv2&amp;f=false">Fundamental Networking in Java</a>:</p>
  
  <blockquote>
    <p>'SSLv2Hello' is a pseudo-protocol which allows Java to initiate the handshake with an SSLv2 'hello message'.  This does <em>not</em> cause use of the SSLv2 protocol, which is not supported by Java at all.</p>
  </blockquote>
  
  <p>And from the <a href="http://download.oracle.com/javase/1.5.0/docs/guide/security/jsse/JSSERefGuide.html">JSSE Reference Guide</a>:</p>
  
  <blockquote>
    <p>The JSSE implementation in the J2SDK 1.4 and later implements SSL 3.0 and TLS 1.0. It does not implement SSL 2.0.</p>
  </blockquote>
  
  <p>Now, my understanding is that version 2.0 client hello should only be sent when the client <strong>does</strong> support SSL version 2.0.  From <a href="http://www.ietf.org/rfc/rfc2246.txt">RFC 2246</a>:</p>
  
  <blockquote>
    <p>TLS 1.0 clients that support SSL Version 2.0 servers must send SSL
       Version 2.0 client hello messages [SSL2] ... <strong>Warning:</strong> The ability to send Version 2.0 client hello messages will be phased out with all due haste.</p>
  </blockquote>
  
  <p>So why does Java use it?</p>