SSLHandshakeException致命警報：handshake_failure

它可以被看作是重複的問題。我已經經歷了所有可能的與此問題相關的stackoverflow線程，我嘗試了所有的解決方案，但沒有運氣。其實應用程序使用httpclient-4.3.4.jar並在java 6上運行。我們不能在java 8上移動應用程序。我附上debug level logs。服務器的SSL Certificate正顯示出The connection to this site is encrypted and authenticated using a strong protocol (TLS 1.2), a strong key exchange (ECDHE_ECDSA), and a strong cipher (AES_128_GCM).SSLHandshakeException致命警報：handshake_failure

Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384 
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA 
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384 
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA 
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384 
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_GCM_SHA384 
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA 
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384 
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA 
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA 
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 
Allow unsafe renegotiation: false 
Allow legacy hello messages: true 
Is secure renegotiation: false 
%% No cached client session 
*** ClientHello, TLSv1.2 
RandomCookie: GMT: 1500422464 bytes = { 244, 1, 120, 102, 154, 157, 165, 201, 76, 12, 37, 6, 102, 104, 27, 126, 218, 227, 252, 79, 141, 224, 3, 232, 45, 196, 255, 209 } 
Session ID: {} 
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] 
Compression Methods: { 0 } 
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1} 
Extension ec_point_formats, formats: [uncompressed] 
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA 
*** 
0000: 01 00 00 C1 03 03 59 6F A1 40 F4 01 78 66 9A 9D [email protected] 
0010: A5 C9 4C 0C 25 06 66 68 1B 7E DA E3 FC 4F 8D E0 ..L.%.fh.....O.. 
0020: 03 E8 2D C4 FF D1 00 00 3A C0 23 C0 27 00 3C C0 ..-.....:.#.'.<. 
0030: 25 C0 29 00 67 00 40 C0 09 C0 13 00 2F C0 04 C0 %.)[email protected]/... 
0040: 0E 00 33 00 32 C0 2B C0 2F 00 9C C0 2D C0 31 00 ..3.2.+./...-.1. 
0050: 9E 00 A2 C0 08 C0 12 00 0A C0 03 C0 0D 00 16 00 ................ 
0060: 13 00 FF 01 00 00 5E 00 0A 00 34 00 32 00 17 00 ......^...4.2... 
0070: 01 00 03 00 13 00 15 00 06 00 07 00 09 00 0A 00 ................ 
0080: 18 00 0B 00 0C 00 19 00 0D 00 0E 00 0F 00 10 00 ................ 
0090: 11 00 02 00 12 00 04 00 05 00 14 00 08 00 16 00 ................ 
00A0: 0B 00 02 01 00 00 0D 00 1C 00 1A 06 03 06 01 05 ................ 
00B0: 03 05 01 04 03 04 01 04 02 03 03 03 01 03 02 02 ................ 
00C0: 03 02 01 02 02 
http-bio-9090-exec-5, WRITE: TLSv1.2 Handshake, length = 197 
[Raw write]: length = 202 
0000: 16 03 03 00 C5 01 00 00 C1 03 03 59 6F A1 40 F4 [email protected] 
0010: 01 78 66 9A 9D A5 C9 4C 0C 25 06 66 68 1B 7E DA .xf....L.%.fh... 
0020: E3 FC 4F 8D E0 03 E8 2D C4 FF D1 00 00 3A C0 23 ..O....-.....:.# 
0030: C0 27 00 3C C0 25 C0 29 00 67 00 40 C0 09 C0 13 .'.<.%.)[email protected] 
0040: 00 2F C0 04 C0 0E 00 33 00 32 C0 2B C0 2F 00 9C ./.....3.2.+./.. 
0050: C0 2D C0 31 00 9E 00 A2 C0 08 C0 12 00 0A C0 03 .-.1............ 
0060: C0 0D 00 16 00 13 00 FF 01 00 00 5E 00 0A 00 34 ...........^...4 
0070: 00 32 00 17 00 01 00 03 00 13 00 15 00 06 00 07 .2.............. 
0080: 00 09 00 0A 00 18 00 0B 00 0C 00 19 00 0D 00 0E ................ 
0090: 00 0F 00 10 00 11 00 02 00 12 00 04 00 05 00 14 ................ 
00A0: 00 08 00 16 00 0B 00 02 01 00 00 0D 00 1C 00 1A ................ 
00B0: 06 03 06 01 05 03 05 01 04 03 04 01 04 02 03 03 ................ 
00C0: 03 01 03 02 02 03 02 01 02 02     .......... 
[Raw read]: length = 5 
0000: 15 03 01 00 02 
[Raw read]: length = 2 
0000: 02 28 
http-bio-9090-exec-5, READ: TLSv1 Alert, length = 2 
http-bio-9090-exec-5, RECV TLSv1.2 ALERT: fatal, handshake_failure 
http-bio-9090-exec-5, called closeSocket() 
http-bio-9090-exec-5, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure 
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

我跟着不同的方法，下文提到的創造的SSLContext。

方法1：

TrustManager[] trustAllCerts = new TrustManager[] {new X509TrustManager() { 
      public java.security.cert.X509Certificate[] getAcceptedIssuers() { 
       return null; 
      } 
      public void checkClientTrusted(X509Certificate[] certs, String authType) { 
      } 
      public void checkServerTrusted(X509Certificate[] certs, String authType) { 
      } 
     } 
    }; 
try 
{ 
    SSLContext sc = SSLContext.getInstance("SSL"); 
    sc.init(null, trustAllCerts, new java.security.SecureRandom()); 
    HostnameVerifier allHostsValid = new HostnameVerifier() { 
    public boolean verify(String hostname, SSLSession session) { 
     return true; 
    } 
}; 
    HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid); 
} catch (Exception e) { 
    logger.info("SOAP SSL Config failed ::: "+e); 
}

方法2：

SSLContext sslContext = SSLContexts.createSystemDefault(); 
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext,SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 
int port = Integer.parseInt(tr.getSupplierSettings().get(PROXY_PORT)); 
CredentialsProvider credsProvider = new BasicCredentialsProvider(); 
credsProvider.setCredentials(new AuthScope(tr.getSupplierSettings().get(PROXY_SUPPLIER_HOST), port), 
      new UsernamePasswordCredentials(tr.getSupplierSettings().get(PROXY_SUPPLIER_USERNAME), 
        tr.getSupplierSettings().get(PROXY_SUPPLIER_PASSWORD))); 
CloseableHttpClient httpclient = HttpClients.custom().setDefaultCredentialsProvider(credsProvider) 
      .setSSLSocketFactory(sslsf).build();

PROXY_SUPPLIER_HOST，PROXY_PORT，PROXY_SUPPLIER_USERNAME和PROXY_SUPPLIER_PASSWORD是constants。我嘗試了其他方法以及在其他線程中提到的其他方法。我試過沒有proxy settings。我希望有人可以閱讀上面提到的日誌，並幫助我解決這個問題。

來源

2017-07-20 sarvesh

服務器的SSL證書不能表現出任何這樣的事情。你的意思是像ssllabs.com這樣的工具嗎？ – EJP

@EJP我在'google chorme'的'security'選項卡下獲得了這些信息，我們可以在其中看到SSL證書信息並下載它 – sarvesh

Java6直到版本6u121才支持TLS v1.2，這需要Oracle的高級支持。你在使用該版本嗎？您的日誌顯示TLSv1.2的ClientHello消息。我建議你用ssllabs.com – pedrofb

正如我們可以在評論部分中看到的，我嘗試將Bouncy provider添加到Security。 Bouncy Provider信息是可用的here 。我加了Security.addProvider(new BouncyCastleProvider());。我加入了maven dependency，如下所述。

<dependency> 
    <groupId>org.bouncycastle</groupId> 
    <artifactId>bcprov-debug-jdk15on</artifactId> 
    <version>1.52</version> 
</dependency>

一切歸功於@ dave_thompson_085

來源

2017-07-21 07:26:20 sarvesh

SSLHandshakeException致命警報：handshake_failure

回答

相關問題