![](/img/trans.png)
[英]MQSC_UNSUPPORTED_CIPHER_SUITE on WAS7/8 for tls_rsa_with_aes_128_cbc_sha256
[英]JDK7 SSL conenction Issue Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
我正在建立SSL连接(作为客户端),根据这篇Oracle文章 ,如果您使用TLSv1.2并启用强制版本的管辖区策略,则JDK7中支持以下两种密码套件。
但是,在进行安全连接时会忽略两个密码算法。
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
**Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384**
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
**Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256**
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie: GMT: 1496192143 bytes = { 166, 200, 78, 178, 69, 10, 17, 174, 212, 142, 188, 108, 136, 152, 242, 222, 94, 231, 4, 86, 2, 99, 202, 4, 204, 130, 236, 120 }
Session ID: {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods: { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA224withECDSA, SHA224withRSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA, MD5withRSA
Extension server_name, server_name: [host_name: api.sms.optus.com.au]
***
main, WRITE: **TLSv1.2** Handshake, length = 222
main, READ: TLSv1.2 Alert, length = 2
main, RECV TLSv1 ALERT: fatal, handshake_failure
main, called closeSocket()
main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
ERROR [main] (TestRest.java:42) - Error :
我已经设置了TLSv1.2
我已经安装了“ JCE Unlimited Strength Jurisdiction Policy Files ”,我可以通过运行以下代码确认其已成功安装
try {
int maxAllowedKeyLength = Cipher.getMaxAllowedKeyLength("AES");
System.out.println("AES: " + maxAllowedKeyLength);
return maxAllowedKeyLength >= 256;
} catch (NoSuchAlgorithmException e) {
return false;
}
我认为JDK7中不支持这两种密码算法,但在Oracle文章中却错误地提到了这些算法?
笔记:
在完成任何定制之前,在SSLContextImpl.init
计算'enabled'密码列表的初始设置,而在Java7客户端中,初始协议列表仅为SSLv3和TLSv1(在最近的版本中,java.security将jdk.tls.disabledAlgorithms
配置为因为POODLE而删除SSLv3所以这会禁用所有仅限TLSv1.2的密码,这是该服务器唯一同意的密码。 这是在实际握手开始之前Ignoring unsupported
跟踪中Ignoring unsupported
消息的来源。
如果使用HttpsURLConnection
需要设置两个 https.protocols
和https.cipherSuites
(注资S)sysprops。 如果直接使用SSLSocket
您需要同时调用.setEnabledProtocols
包括(至少) TLSv1.2
和.setEnabledCipherSuites
包括(至少)您在Q中突出显示的密码套件之一,或替换/包装工厂以执行等效操作。
Java8没有问题,因为客户端和服务器的默认协议列表是SSLv3,TLSv1,TLSv1.1,TLSv1.2,再次通过jdk.tls.disabledAlgorithms
删除SSLv3
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.