Error communicating with AD - server certificate change is restrictedduring renegotiation

Question

We've been getting an error intermittently where our app can't connect to our Active Directory.

We're current on jBoss 5 and Java 7 with plans to upgrade to 6 and 8 in the future. Could this be because of bad certificates on the domain controllers?

Error

  javax.naming.CommunicationException: simple bind failed: ad.xxx.com:636 [Root exception is javax.net.ssl.SSLHandshakeException: server certificate change is restrictedduring renegotiation]
        at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:218)
        at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2740)
        at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:316)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:193)
        at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:211)
        at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:154)
        at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:84)
Caused by: javax.net.ssl.SSLHandshakeException: server certificate change is restrictedduring renegotiation
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1904)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:279)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:269)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1409)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:209)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:913)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:849)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1023)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1332)
    at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:709)
    at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:122)
    at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
    at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
    at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:431)
    at com.sun.jndi.ldap.Connection.writeRequest(Connection.java:404)
    at com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:358)
    at com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:213)
    ... 54 more

Answer 1

I believe this error message in client layer code is a consequence of code hardening following "SSL V3.0 Poodle Vulnerability - CVE-2014-3566 " from Java updates.

IMHO, this is a bug from Java.

From what I have observed and understand this is caused by the Java client have had an Existing SSL connection with the same server (Microsoft Active Directory) in your case.

The Java Client attempts to fails to perform a Full Handshake and tries to Resume the TLS handshake the previous connection.

Appears you may be able to perform a workaround by disable SSL v3.0 in TLS Client Oracle JDK and JRE .

Any other feedback on this issue would be appreciated.