无法发送显示SocketException的帖子https请求：连接重置

Question

I am sending the https request. I have added the client certificate and import to jvm still not able to execute the request, Showing connection request.

private static Registry<ConnectionSocketFactory> scheme = null;

static {

    SSLConnectionSocketFactory socketFactory = null;

    try {
        System.setProperty("javax.net.debug", "all");

        String KEYSTORE_LOCATION = "C:\\Users\\pritesha\\Desktop\\TS1_certs\\wwwin-ts1fin.cisco.com.jks";   
        FileInputStream is = new FileInputStream(new File(KEYSTORE_LOCATION));
        KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
        trustStore.load(is, "changeit".toCharArray());

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(trustStore);
        SSLContext ctx = SSLContext.getInstance("TLSv1");
        ctx.init(null, tmf.getTrustManagers(), null);
        SSLSocketFactory sslFactory = ctx.getSocketFactory();


        SSLContextBuilder sslContextBuilder = SSLContexts.custom().useTLS().loadTrustMaterial(trustStore);
        socketFactory = new SSLConnectionSocketFactory(sslContextBuilder.build());
    } catch (KeyStoreException e) {
        System.out.println("Exception in the loading Key Store...  " + e.getMessage());
    } catch (KeyManagementException e) {
        System.out.println("Exception in the loading Key Store...  " + e.getMessage());
    } catch (NoSuchAlgorithmException e) {
        System.out.println("Exception in the loading Key Store...  " + e.getMessage());
    } catch (CertificateException e) {
        System.out.println("Exception in the loading Key Store...  " + e.getMessage());
    } catch (IOException e) {
        System.out.println("Exception in the loading Key Store...  " + e.getMessage());
    }
    scheme = RegistryBuilder.<ConnectionSocketFactory>create().register("https", socketFactory).build();
}

public static String connect() {
    CloseableHttpClient httpclient = null;
    try {
        String URL = "https://wwwin-ts1fin.cisco.com/bpelpcicreatereceipt_client_ep";
        String requestBody = "<SOAP-ENV:Envelope xmlns:SOAP-ENV=\"http://schemas.xmlsoap.org/soap/envelope/\" xmlns:ns1=\"http://xmlns.oracle.com/I2C/PrjPCIReceiptCreation/BPELPCICreateReceipt\"><SOAP-ENV:Header/><SOAP-ENV:Body>"
                + "<ns1:process><ns1:SourceSystem>CCW</ns1:SourceSystem> <ns1:PaymentId>" + 123
                + "</ns1:PaymentId> <ns1:Retry>No</ns1:Retry></ns1:process></SOAP-ENV:Body></SOAP-ENV:Envelope>";

        PoolingHttpClientConnectionManager connectionManager = new PoolingHttpClientConnectionManager(scheme);
        connectionManager.setMaxTotal(200);
        connectionManager.setDefaultMaxPerRoute(20);

        httpclient = HttpClients.custom().setConnectionManager(connectionManager).build();

        HttpPost httpPost = new HttpPost(URL);

        httpPost.setHeader("Content-Type", "text/xml");

        httpPost.setEntity(new StringEntity(requestBody));

        HttpResponse httpResponse = httpclient.execute(httpPost);

        HttpEntity entity = httpResponse.getEntity();

        if (entity != null) {
            return EntityUtils.toString(entity);
        }
    } catch (MalformedURLException e) {
        e.printStackTrace();
    } catch (IOException e) {
        e.printStackTrace();
    }
    return null;
}

This is the full stacktrace I get:

[Raw read]: length = 5 0000: 15 03 03 00 02 ..... main, handling exception: java.net.SocketException: Connection reset main, SEND TLSv1 ALERT: fatal, description = unexpected_message main, WRITE: TLSv1 Alert, length = 2 main, Exception sending alert: java.net.SocketException: Connection reset by peer: socket write error main, called closeSocket()

Answer 1

First, this being an TLS alert, you need much better insight of what alert it is. Install wireshark and sniff the session. Drill down in the alert msg and wireshark dissectors will explain a bit more the issue.

I suspect you don't have a common cipher suite negociated. You chose tls v1 but cicso might have higher version, hence a set cipher suites you chose not to offer by downgrading to tls 1.0 (which is ssl v3, not surprisingly rejected by cisco).