在tomcat環境中獲取javax.net.ssl.SSLHandshakeException

我在嘗試連接到https站點的異常中掙扎。我的代碼是用Java編寫的。它從我的筆記本電腦工作，但不是從我的Linux服務器，我不知道如何調試。在tomcat環境中獲取javax.net.ssl.SSLHandshakeException

我已經檢索到SSL證書並導入到cacerts truststore。

的Java代碼是下面

 System.setProperty("javax.net.debug", "ssl"); 

     String cacerts_file = System.getProperty("java.home") 
       + "/lib/security/cacerts".replace('/', File.separatorChar); 

     System.out.println(System.getProperty("javax.net.ssl.trustStore")); 
     System.out.println("cacerts_file: " + cacerts_file); 

     System.out.println(System.getProperty("javax.net.ssl.trustStore")); 

     KeyStore ks = KeyStore.getInstance("JKS"); 
     FileInputStream in2 = new FileInputStream(cacerts_file); 
     ks.load(in2, "changeit".toCharArray()); 

     System.out.println(ks.containsAlias("badoojira")); 
     Enumeration<String> lAliases = ks.aliases(); 
     while (lAliases.hasMoreElements()) { 
      String lAlias = (String) lAliases.nextElement(); 
      System.out.println(lAlias); 
     } 

     javax.net.ssl.KeyManagerFactory lKeyManagerFactory = javax.net.ssl.KeyManagerFactory 
       .getInstance("SunX509"); 
     lKeyManagerFactory.init(ks, "changeit".toCharArray()); 
     javax.net.ssl.SSLContext lSSLContext = javax.net.ssl.SSLContext.getInstance("TLS"); 
     lSSLContext.init(lKeyManagerFactory.getKeyManagers(), null, null); 
     SSLSocketFactory lSSLSocketFactory = lSSLContext.getSocketFactory(); 
     javax.net.ssl.HttpsURLConnection.setDefaultSSLSocketFactory(lSSLSocketFactory); 
     SSLSocket socket = (SSLSocket) lSSLSocketFactory 
       .createSocket("wiki.badoojira.com", 443); 
     String[] suites = socket.getSupportedCipherSuites(); 
     socket.setEnabledCipherSuites(suites); 

     // start handshake 
     socket.startHandshake();

我在服務器已經驗證與密鑰存儲命令，通過System.getProperty指向的cacerts中（「java.home」）+ 「/ LIB /安全/ cacerts中」 .replace（'/'，File.separatorChar）通過調用「keystore -list」具有實際的證書。

唯一的例外是：

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure 
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) 
at sun.security.ssl.Alerts.getSSLException(Alerts.java:154) 
at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1718) 
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:962) 
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1143) 
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1170) 
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1154) 
at com.corp.GetStatusPage.oneMoreTest(GetStatusPage.java:105) 
at com.corp.GetStatusPage.main(GetStatusPage.java:35)

隨着調試跟蹤（編輯）

cacerts_file: /usr/lib64/jvm/java-1.7.0-sun-1.7.0/jre/lib/security/cacerts 
    default truststore: /usr/lib64/jvm/java-1.7.0-sun-1.7.0/jre/lib/security/cacerts 
    null 
    true 

    digicertassuredidrootca 
    trustcenterclass2caii 
    thawtepremiumserverca 
    certifjira.com <<-- My certificate 

    [Edited - removed all other default certificates aliases] 

    trustStore is: /usr/lib64/jvm/java-1.7.0-sun-1.7.0/jre/lib/security/cacerts 
    trustStore type is : jks 
    trustStore provider is : 
    init truststore 
    adding as trusted cert: 
     Subject: CN=SwissSign Platinum CA - G2, O=SwissSign AG, C=CH 
     Issuer: CN=SwissSign Platinum CA - G2, O=SwissSign AG, C=CH 
     Algorithm: RSA; Serial number: 0x4eb200670c035d4f 
     Valid from Wed Oct 25 08:36:00 UTC 2006 until Sat Oct 25 08:36:00 UTC 2036 

    adding as trusted cert: 
     Subject: [email protected], CN=Thawte Personal Freemail CA, OU=Certification Services Division, O=Thawte Consulting, L=Cape Town, ST=Western Cape, C=ZA 
     Issuer: [email protected], CN=Thawte Personal Freemail CA, OU=Certification Services Division, O=Thawte Consulting, L=Cape Town, ST=Western Cape, C=ZA 
     Algorithm: RSA; Serial number: 0x123df0e7da2a2247a43889e08aeec967 
     Valid from Mon Jan 01 00:00:00 UTC 1996 until Fri Jan 01 23:59:59 UTC 2021 

    adding as trusted cert: 
     Subject: [email protected], CN=Thawte Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA 
     Issuer: [email protected], CN=Thawte Server CA, OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town, ST=Western Cape, C=ZA 
     Algorithm: RSA; Serial number: 0x34a4fff630af4ca53c331742a1946675 
     Valid from Thu Aug 01 00:00:00 UTC 1996 until Fri Jan 01 23:59:59 UTC 2021 

    adding as trusted cert: 
     Subject: CN=*.certifjira.com, O=Trading Limited, L=London, ST=United Kingdom, C=GB 
     Issuer: CN=VeriSign Class 3 Secure Server CA - G3, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US 
     Algorithm: RSA; Serial number: 0x62a8e5628239c977eab16142cf0e8e0f 
     Valid from Tue May 27 00:00:00 UTC 2014 until Thu May 28 23:59:59 UTC 2015 

    [Edited to remove default certificates] 

    trigger seeding of SecureRandom 
    done seeding SecureRandom 
    %% No cached client session 
    *** ClientHello, TLSv1 
    RandomCookie: GMT: 1415190323 bytes = { 8, 10, 86, 52, 89, 227, 192, 166, 138, 175, 232, 157, 182, 160, 237, 133, 188, 63, 103, 151, 97, 195, 110, 180, 183, 28, 103, 245 } 
    Session ID: {} 
    Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RSA_WITH_NULL_MD5, SSL_RSA_WITH_NULL_SHA, TLS_ECDH_ECDSA_WITH_NULL_SHA, TLS_ECDH_RSA_WITH_NULL_SHA, TLS_ECDHE_ECDSA_WITH_NULL_SHA, TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_DH_anon_WITH_RC4_128_MD5, TLS_DH_anon_WITH_AES_128_CBC_SHA, SSL_DH_anon_WITH_3DES_EDE_CBC_SHA, SSL_DH_anon_WITH_DES_CBC_SHA, TLS_ECDH_anon_WITH_RC4_128_SHA, TLS_ECDH_anon_WITH_AES_128_CBC_SHA, TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA, SSL_DH_anon_EXPORT_WITH_RC4_40_MD5, SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA, TLS_ECDH_anon_WITH_NULL_SHA, TLS_KRB5_WITH_RC4_128_SHA, TLS_KRB5_WITH_RC4_128_MD5, TLS_KRB5_WITH_3DES_EDE_CBC_SHA, TLS_KRB5_WITH_3DES_EDE_CBC_MD5, TLS_KRB5_WITH_DES_CBC_SHA, TLS_KRB5_WITH_DES_CBC_MD5, TLS_KRB5_EXPORT_WITH_RC4_40_SHA, TLS_KRB5_EXPORT_WITH_RC4_40_MD5, TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA, TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5] 
    Compression Methods: { 0 } 
    Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1} 
    Extension ec_point_formats, formats: [uncompressed] 
    *** 
    main, WRITE: TLSv1 Handshake, length = 213 
    main, WRITE: SSLv2 client hello message, length = 227 
    main, READ: TLSv1 Alert, length = 2 
    main, RECV TLSv1 ALERT: fatal, handshake_failure 
    main, called closeSocket() 
    main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

非常感謝您的幫助。

來源

2014-11-04 DavidU

由於一些問題在這裏我能找到的是我的2種環境下加入到我的代碼不同啓用的協議如下：

 String[] lEnabledProtocols = socket.getEnabledProtocols(); 
    for (int i = 0; i < lEnabledProtocols.length; i++) { 
     String lProtocol = lEnabledProtocols[i]; 
     System.out.println("\t" + lProtocol); 
    }

這表明，在工作環境我是隻有獲得SSLv3，TLSv1，而在SSLv2Hello，SSLv3，TLSv1握手失敗。所以我試着專門設置啓用的協議。

 String[] lMyProtocols = { "SSLv3", "TLSv1" }; 
     socket.setEnabledProtocols(lMyProtocols);

這證明適用於我。希望明確設置這些協議沒有缺點。

來源

2014-11-07 11:37:16 DavidU

沒有直接的負面影響，但隨着時間的推移，這可能會使您的應用過時。例如。如果問題是我在j6上猜到client = tomcat，並且有一天會升級到j8，並且服務器實現在TLS1之上 - 並且* if *服務器是java，因爲它拒絕了v2hello，表明它至少是j7， *）*支持1.1和1.2 - *然後*這不會得到新的協議。現在有針對SSL3和TLS1.0的攻擊，這對您的應用可能實際上可能並不重要，但對審計員防火牆等可能依然重要。 ... – 2014-11-08 11:24:54

...以「futureproof」我會'.getEnabledProtocols'，*如果*'SSLv2Hello'存在刪除它（使用臨時ArrayList）並設置它。這將強制*最小* SSL3，但讓JVM增加最大值。 – 2014-11-08 11:27:35

您的javax.net.ssl.trustStore設置僅實現默認設置。刪除它們。
密鑰庫不是信任庫。除非您通過向其添加自己的私鑰和證書來聲明Java信任庫，否則您指定的密鑰庫應該與信任庫不同。
除非要連接的服務器需要客戶端證書，否則根本不需要密鑰庫。所以修復或刪除這個。
您需要將確切的異常和堆棧跟蹤粘貼到問題中以獲得進一步的幫助。

來源

2014-11-05 00:16:54 EJP

我簡化了代碼，刪除了提到的元素，在ssl中添加了堆棧跟蹤和調試信息。 – DavidU 2014-11-05 12:42:20

在tomcat環境中獲取javax.net.ssl.SSLHandshakeException

回答

相關問題