SOAP Client: Client TLS credential selection

[Brent Putman]

On 5/13/15 7:46 PM, Cantor, Scott wrote:
> That kind of persuades me that it's a good idea, because recent years have 
> demonstrated that per-connection control over TLS versions and ciphers is 
> increasingly needed to deal with security issues much like it is with 
> SHA-1 now.

Looking at it just now, actually looks like it would be pretty easy to
do with a custom HC socket factory.  It's just overriding 1 method. 
The enabled cipher suites and TLS protocol version are not ultimately
in the SSContext like I thought, it's the HC socket factory that does
it.  And it has access to the HttpContext, so it would be easy to pass
on a per-request basis that way. 

In fact, assuming it works the way I think, I may submit a patch to
them for this to get into the main codebase, and eliminate the need for
a custom override.  Seems pretty straightforward.

>
> People will definitely want to be able to turn on broken features for 
> specific partners and not globally.

Yeah, I think it's not a problem, even if we go the single SOAP client
route.