如何设置基本的Jersey / Grizzly 2.21 SSL启动配置

Question

I'm trying to get a very basic Grizzly server up and running to allow for one-way SSL (HTTPS) connections to access jax-rs REST services. Eventually I want two-way SSL security.

I've gone through many of the examples and I just can't get anything to work. I keep running into a SSL Handshake error. Clearly I must be doing something stupid. Any help is appreciated.

Here is my code to start my embedded Grizzly server using the Jersey wrapper classes:

public static HttpServer startHttpsServer(URI listenerURI) throws IOException  {
  ResourceConfig resourceConfig = new ResourceConfig().packages("ws.argo.experiment.ssl");

  // First I tried this configuration using the certs from the Jersey sample code
  // Grizzly ssl configuration
  SSLContextConfigurator sslContext = new SSLContextConfigurator();

  // set up security context
  sslContext.setKeyStoreFile("./src/main/resources/keystore_server"); // contains server keypair
  sslContext.setKeyStorePass("asdfgh");
  sslContext.setTrustStoreFile("./src/main/resources/truststore_server"); // contains client certificate
  sslContext.setTrustStorePass("asdfgh");

  // Then I tried just using a default config - didn't work either
  //    sslContext = SSLContextConfigurator.DEFAULT_CONFIG;


  if (!sslContext.validateConfiguration(true)) {
    LOGGER.severe("Context is not valid");

  }

  LOGGER.finer("Starting Jersey-Grizzly2 JAX-RS secure server...");
  HttpServer httpServer; //=   GrizzlyHttpServerFactory.createHttpServer(listenerURI, resourceConfig, false);


  httpServer= GrizzlyHttpServerFactory.createHttpServer(
      listenerURI,
      resourceConfig,
      true,
      new   SSLEngineConfigurator(sslContext).setClientMode(false).setNeedClientAuth(false)
      );



  httpServer.getServerConfiguration().setName("Test HTTPS Server");
  httpServer.start();
  LOGGER.info("Started Jersey-Grizzly2 JAX-RS secure server.");

  return httpServer;
}

I also tried replaced SSLEngineConfigurator(sslContext).setClientMode(false).setNeedClientAuth(false) with null to see if that would help. Nope.

I always get the following error:

grizzly-nio-kernel(3) SelectorRunner, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated:  [Session-2, SSL_NULL_WITH_NULL_NULL]
grizzly-nio-kernel(3) SelectorRunner, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
grizzly-nio-kernel(3) SelectorRunner, WRITE: TLSv1.2 Alert, length = 2
grizzly-nio-kernel(3) SelectorRunner, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common

Answer 1

To add on top of JMS comment, his answer solve my problem too . Here is the command i used to generate the RSA certificate .

keytool -genkey -keystore ./keystore_client -alias clientKey -keyalg RSA -keypass changeit -storepass changeit -dname "CN=Client, OU=Jersey, O=changeit, L=KL, ST=SEL, C=MY"
keytool -export -alias clientKey -storepass changeit -keystore ./keystore_client -file ./client.cert
keytool -import -alias clientCert -file ./client.cert -storepass changeit -keystore ./truststore_server


keytool -genkey -keystore ./keystore_server -alias serverKey -keyalg RSA -keyalg RSA -keypass changeit -storepass changeit -dname "CN=changeit, OU=Jersey, O=changeit, L=KL, ST=SEL, C=MY"
keytool -export -alias serverKey -storepass changeit -keystore ./keystore_server -file ./server.cert
keytool -import -alias serverCert -file ./server.cert -storepass changeit -keystore ./truststore_client

Answer 2

I have seen this type of handshake issue come up in other posts while trying to run this issue to ground. In all of these handshake posts, the server key algorithm was never discussed - I wish it had been. It would have saved me a couple of hours. The issue that caused the above errors stemmed from assuming that the keystores that were created as part of the Jersey sample project would work. The server key was the problem.

The sample server certs are generated using the DSA algorithm. Apparently this is an issue.

I recreated the server keys using a RSA algorithm and 2048 bit strength. I restarted the server and the everything started to work like one would expect.

The error was that I assumed that the "sample" keys would work. Oops.