javademos/jep-tour/src/TlsPeer.java

import java.io.InputStream;
import java.net.InetAddress;
import java.nio.file.Files;
import java.nio.file.Path;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;

/**
 * One end of a loopback TLS 1.3 handshake, so two different JDKs can be pointed at each other.
 *
 * <pre>
 *   java TlsPeer server &lt;portfile&gt;   listen on an ephemeral port, write the port to a file, serve one handshake
 *   java TlsPeer client &lt;port&gt;       connect and complete a handshake
 * </pre>
 *
 * The scripts run both with -Djavax.net.debug=ssl:handshake and read the negotiated key-exchange group
 * out of the debug log; no JDK API reports it directly. Explained in docs/04-post-quantum-tls.md.
 */
public class TlsPeer {

    public static void main(String[] args) throws Exception {
        if (args[0].equals("server")) {
            SSLServerSocket server = (SSLServerSocket) SSLServerSocketFactory.getDefault()
                    .createServerSocket(0, 1, InetAddress.getLoopbackAddress());
            Files.writeString(Path.of(args[1]), Integer.toString(server.getLocalPort()));
            try (SSLSocket socket = (SSLSocket) server.accept()) {
                socket.startHandshake();
                socket.getOutputStream().write('!');
            }
            server.close();
        } else {
            SSLSocket socket = (SSLSocket) SSLSocketFactory.getDefault()
                    .createSocket(InetAddress.getLoopbackAddress(), Integer.parseInt(args[1]));
            socket.startHandshake();
            System.out.println("handshake complete: " + socket.getSession().getProtocol()
                    + " " + socket.getSession().getCipherSuite());
            InputStream in = socket.getInputStream();
            in.read();
            socket.close();
        }
    }
}