javax.net.ssl.SSLContext.getInstance returns a SSLContext object that implements the specified secure socket protocol. However, not all protocols are created equal and some legacy ones like "SSL", have been proven to be insecure.

This rule raises an issue when an SSLContext is created with an insecure protocol (ie: a protocol different from "TLSv1.2" or "DTLSv1.2").

Noncompliant Code Example

context = SSLContext.getInstance("SSL"); // Noncompliant

Compliant Solution

context = SSLContext.getInstance("TLSv1.2");

See