Comment by richm44

You do realise that JSSE has lots of timing attacks etc. and that's pretty much unfixable in managed code? It's also had numerous bugs in it's SSL/TLS implementation (mainly because no one uses it) such as mishandling zero length extensions (used for flagging support for a feature), failing to handle DH params that aren't a multiple of 64 bits (no sane reason) etc.