title: Java http clients and POODLE
body: <p>Regarding the POODLE vulnerability, if I understand it correctly, it requires a client that automatically downgrades TLS protocol to SSLv3 when failing to establish a secure channel with a server using higher version protocol advertised by the server.</p>
  
  <p>Do the common java HTTP client libraries, specifically javax.net.ssl.HttpsURLConnection and Apache HttpClient, automatically downgrade the TLS protocol when failing to establish TLS session with a server? If not, am I correct that they are immune from he POODLE attack unless either (a) the server only supports SSLv3, or (b) a logic at a higher level performs the downgrade?</p>
  
  <p>I'm looking for something like <a href="http://blog.hagander.net/archives/222-A-few-short-notes-about-PostgreSQL-and-POODLE.html" rel="noreferrer">http://blog.hagander.net/archives/222-A-few-short-notes-about-PostgreSQL-and-POODLE.html</a> but for Java clients.</p>