壞SSL握手澤西

鑑於這種球衣初始化代碼：壞SSL握手澤西

boolean clientMode = false, 
      needClientAuth = true, 
      wantClientAuth = true; 
    SSLContext sslcconf = SSLContext.getDefault(); 
    SSLEngineConfigurator ssleconf = new SSLEngineConfigurator(sslcconf, clientMode, needClientAuth, wantClientAuth); 
    boolean secure = true, 
      start = true; 
    ResourceConfig resconf = new ResourceConfig(classes); 
    HttpServer server = GrizzlyHttpServerFactory.createHttpServer(
     new URI("https://localhost:8080"), 
     resconf, secure, ssleconf, start);

的所有客戶端試圖連接到該服務器拋出通用SSL握手錯誤。特別是：

$ openssl s_client -debug -msg -connect localhost:8080 
CONNECTED(00000003) 
write to 0xa024118 [0xa024b48] (118 bytes => 118 (0x76)) 
0000 - 80 74 01 03 01 00 4b 00-00 00 20 00 00 39 00 00 .t....K... ..9.. 
0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 
0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 05 00 ..3..2../....... 
0030 - 00 04 01 00 80 00 00 15-00 00 12 00 00 09 06 00 ................ 
0040 - 40 00 00 14 00 00 11 00-00 08 00 00 06 04 00 80 @............... 
0050 - 00 00 03 02 00 80 bf 3e-48 68 ef c9 6f aa 65 88 .......>Hh..o.e. 
0060 - 86 e7 eb 77 e9 be 3c 69-67 0b 3c ae 3a dc 69 5f ...w..<ig.<.:.i_ 
0070 - ad c0 c4 93 61 ce         ....a. 
>>> SSL 2.0 [length 0074], CLIENT-HELLO 
    01 03 01 00 4b 00 00 00 20 00 00 39 00 00 38 00 
    00 35 00 00 16 00 00 13 00 00 0a 07 00 c0 00 00 
    33 00 00 32 00 00 2f 03 00 80 00 00 05 00 00 04 
    01 00 80 00 00 15 00 00 12 00 00 09 06 00 40 00 
    00 14 00 00 11 00 00 08 00 00 06 04 00 80 00 00 
    03 02 00 80 bf 3e 48 68 ef c9 6f aa 65 88 86 e7 
    eb 77 e9 be 3c 69 67 0b 3c ae 3a dc 69 5f ad c0 
    c4 93 61 ce 
read from 0xa024118 [0xa02a0a8] (7 bytes => 0 (0x0)) 
21856:error:140790E5:SSL routines:SSL23_WRITE:ssl handshake failure:s23_lib.c:188:

具有良好的請求到不同的服務器比較：

CONNECTED(00000003) 
write to 0xa024138 [0xa024b48] (118 bytes => 118 (0x76)) 
0000 - 80 74 01 03 01 00 4b 00-00 00 20 00 00 39 00 00 .t....K... ..9.. 
0010 - 38 00 00 35 00 00 16 00-00 13 00 00 0a 07 00 c0 8..5............ 
0020 - 00 00 33 00 00 32 00 00-2f 03 00 80 00 00 05 00 ..3..2../....... 
0030 - 00 04 01 00 80 00 00 15-00 00 12 00 00 09 06 00 ................ 
0040 - 40 00 00 14 00 00 11 00-00 08 00 00 06 04 00 80 @............... 
0050 - 00 00 03 02 00 80 b1 33-32 65 f0 53 60 2d aa 85 .......32e.S`-.. 
0060 - b1 5c 19 1f f2 5b 8b 1a-2d 8a ed 8f c0 79 f7 72 .\...[..-....y.r 
0070 - 9c 31 b3 ec 39 b5         .1..9. 
>>> SSL 2.0 [length 0074], CLIENT-HELLO 
    01 03 01 00 4b 00 00 00 20 00 00 39 00 00 38 00 
    00 35 00 00 16 00 00 13 00 00 0a 07 00 c0 00 00 
    33 00 00 32 00 00 2f 03 00 80 00 00 05 00 00 04 
    01 00 80 00 00 15 00 00 12 00 00 09 06 00 40 00 
    00 14 00 00 11 00 00 08 00 00 06 04 00 80 00 00 
    03 02 00 80 b1 33 32 65 f0 53 60 2d aa 85 b1 5c 
    19 1f f2 5b 8b 1a 2d 8a ed 8f c0 79 f7 72 9c 31 
    b3 ec 39 b5 
read from 0xa024138 [0xa02a0a8] (7 bytes => 7 (0x7)) 
0000 - 16 03 01 00 4a 02         ....J. 
0007 - <SPACES/NULS> 
...

編輯：

boolean clientMode = false, 
      needClientAuth = true, 
      wantClientAuth = true; 
    SSLContextConfigurator sslcconf = new SSLContextConfigurator(); 
    sslcconf.setSecurityProtocol("TLSv1.2"); 
    SSLEngineConfigurator ssleconf = new SSLEngineConfigurator(sslcconf, clientMode, needClientAuth, wantClientAuth); 
    ssleconf.setEnabledProtocols(new String[] { "TLSv1.2" }); 
    ssleconf.setEnabledCipherSuites(new String[] { 
      "TLS_RSA_WITH_AES_128_CBC_SHA256", 
      "TLS_RSA_WITH_AES_256_CBC_SHA256", 
      "TLS_RSA_WITH_AES_128_GCM_SHA256", 
      "TLS_RSA_WITH_AES_256_GCM_SHA384", 
      "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256", 
      "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384", 
      "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256", 
      "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384", 
      "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256", 
      "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384", 
      "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256", 
      "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" 
    }); 

    // SSLContext sslcconf = SSLContext.getDefault(); 
    boolean secure = true, 
      start = true; 
    ResourceConfig resconf = new ResourceConfig(classes); 
    HttpServer server = GrizzlyHttpServerFactory.createHttpServer(
     new URI("https://localhost:8080"), 
     resconf, secure, ssleconf, start);

來源

2014-10-16 Reinderien

嘗試在s_client中使用-ssl2選項。如果可行，你應該知道sslv2有很多問題。 – Khanna111 2014-12-01 19:31:33

這實際上是這樣的：儘管明確的密碼下產生類似的結果一個OpenSSL問題。您連接的服務器是否禁用了SSLv3？您需要檢查在該客戶端上運行的OpenSSL的版本。如果安裝了0.9.x分支，則默認上下文不包括TLS，即使該庫可以支持TLS。在上面發佈的代碼中，默認情況下是默認情況下，而不是指定自己的情況，所以在這種情況下，在遠程禁用SSLv3時，您將無法連接。

你這裏有幾個選擇，如果這是真的：

遙控器上啓用SSLv3的（不這樣做）
更新您的客戶端上的1.x的OpenSSL的分支，它應該有一個更現代的默認上下文
更改您的代碼以修改您的上下文並明確定義您的密碼字符串。

來源

2014-10-16 20:11:59

請參閱更新的問題。謝謝。 – Reinderien 2014-10-16 20:47:45

我已經明確添加了密碼列表，但似乎沒有改變行爲。 – Reinderien 2014-10-17 16:00:36

對不起奇怪的問題，但是你配置了SSLContextConfigurator的Keystore（有正確的密碼等）嗎？

如果您忘記這麼做或者從密鑰庫中不能獲取密鑰（由於配置錯誤或錯誤），將使用「SSL_NULL_WITH_NULL_NULL」作爲密碼，然後您將得到「無共同密碼套件」和握手失敗。

來源

2014-12-01 19:17:59 Grigory

壞SSL握手澤西

回答

相關問題