SSLSocketFactory proxy fails in Applet when using HTTP(S) proxy

Question

As part of some security feature of a new eID Applet, available at [http://code.google.com/p/eid-applet/|http://code.google.com/p/eid-applet/] I need to get access to the SSL session identifier. For this I'm using a custom SSLSocketFactory, of which the implementation is available at:
[AppletSSLSocketFactory.java|http://code.google.com/p/eid-applet/source/browse/trunk/eid-applet-core/src/main/java/be/fedict/eid/applet/AppletSSLSocketFactory.java]
Basically this custom SSLSocketFactory is delegating every method invocation to the original SSLSocketFactory. The only additional functionality is the readout of the SSL session identifier.
I install my custom SSLSocketFactory via:
SSLSocketFactory sslSocketFactory = HttpsURLConnection.getDefaultSSLSocketFactory();
AppletSSLSocketFactory appletSslSocketFactory = new AppletSSLSocketFactory(sslSocketFactory);
HttpsURLConnection.setDefaultSSLSocketFactory(appletSslSocketFactory);Now the eID Applet no longer works if I'm sitting behind a proxy server. I get an exception as shown below. Anyone any idea why this is happening? I read somewhere that HttpsURLConnection indeed is using the browser proxy settings. So I would expect that delegating everything to the original SSLSocketFactory wouldn't break anything...
error: Broken pipe
error type: java.net.SocketException
at java.net.SocketOutputStream.socketWrite0:-2
at java.net.SocketOutputStream.socketWrite:92
at java.net.SocketOutputStream.write:136
at com.sun.net.ssl.internal.ssl.OutputRecord.writeBuffer:295
at com.sun.net.ssl.internal.ssl.OutputRecord.write:284
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecordInternal:734
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord:722
at com.sun.net.ssl.internal.ssl.Handshaker.sendChangeCipherSpec:606
at com.sun.net.ssl.internal.ssl.ClientHandshaker.sendChangeCipherAndFinish:868
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone:794
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage:226
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop:516
at com.sun.net.ssl.internal.ssl.Handshaker.process_record:454
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord:884
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readDataRecord:746
at com.sun.net.ssl.internal.ssl.AppInputStream.read:75
at java.io.BufferedInputStream.fill:218
at java.io.BufferedInputStream.read1:258
at java.io.BufferedInputStream.read:317
at sun.net.www.http.HttpClient.parseHTTPHeader:687

Answer 1

You can get the session after the SSLSocket is fully constructed and connected. That depends on what else your createSocket() method does, but in general doing that just before you return is best.
However the session is a property of the session, not the socket, or the factory, so the lifetimes are all wrong. The session can survive the SSLSocket, or the other way round. To avoid that I think you should set enableSessionCreation to false on the SSLSocket after the handshake.