嘗試通過SSL連接到服務器的SSLHandshakeException

Question

我正在嘗試通過SSL向遠程服務器上的Java / Spring 4應用程序發出GET請求。 說資源是：

HTTPS：//remote-app/foo.pdf

我的應用程序使用https://github.com/square/okhttp作為HTTP客戶端來執行操作。

不幸的是，這是對這些資源的例外; 但令人驚訝的是，在其他服務器上通過SSL公開的其他資源上取得了成功。

這是我得到的例外：

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.8.0_51]
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:154) ~[na:1.8.0_51]
    at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:2023) ~[na:1.8.0_51]
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1125) ~[na:1.8.0_51]
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) ~[na:1.8.0_51]
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403) ~[na:1.8.0_51]
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387) ~[na:1.8.0_51]
    at com.squareup.okhttp.internal.http.SocketConnector.connectTls(SocketConnector.java:103) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.Connection.connect(Connection.java:143) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.Connection.connectAndSetOwner(Connection.java:185) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.OkHttpClient$1.connectAndSetOwner(OkHttpClient.java:128) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.internal.http.HttpEngine.nextConnection(HttpEngine.java:341) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:330) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:248) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.Call.getResponse(Call.java:273) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.Call$ApplicationInterceptorChain.proceed(Call.java:230) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.Call.getResponseWithInterceptorChain(Call.java:201) ~[okhttp-2.4.0.jar!/:na]
    at com.squareup.okhttp.Call.execute(Call.java:81) ~[okhttp-2.4.0.jar!/:na]
    at com.org.package.util.Utils.getUrlResponse(MyUtils.java:54) ~[app-0.0.1-SNAPSHOT.jar!/:na]
    at com.org.package.service.impl.MyApp.uploadUrl(MyApp.java:303) [app.jar!/:na]
    at com.org.package.service.impl.MyApp.uploadResource(MyApp.java:135) [app.jar!/:na]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_51]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_51]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_51]
    at java.lang.reflect.Method.invoke(Method.java:497) ~[na:1.8.0_51]
    at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:317) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.invokeJoinpoint(ReflectiveMethodInvocation.java:190) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99) [spring-tx-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:281) [spring-tx-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96) [spring-tx-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:207) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at com.sun.proxy.$Proxy155.uploadR(Unknown Source) [na:na]
    at com.org.myprocess.receiveRequest(Processor.java:42) [app.jar!/:na]
    at com.org.myprocess$$FastClassBySpringCGLIB$$e05dc31.invoke(<generated>) [spring-core-4.1.7.RELEASE.jar!/:na]
    at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) [spring-core-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.aop.framework.CglibAopProxy$CglibMethodInvocation.invokeJoinpoint(CglibAopProxy.java:717) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:157) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.transaction.interceptor.TransactionInterceptor$1.proceedWithInvocation(TransactionInterceptor.java:99) [spring-tx-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.transaction.interceptor.TransactionAspectSupport.invokeWithinTransaction(TransactionAspectSupport.java:281) [spring-tx-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.transaction.interceptor.TransactionInterceptor.invoke(TransactionInterceptor.java:96) [spring-tx-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.aop.framework.ReflectiveMethodInvocation.proceed(ReflectiveMethodInvocation.java:179) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:653) [spring-aop-4.1.7.RELEASE.jar!/:4.1.7.RELEASE]
    at com.org.myprocess$$EnhancerBySpringCGLIB$$d16a8116.receiveRequest(<generated>) [spring-core-4.1.7.RELEASE.jar!/:na]
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[na:1.8.0_51]
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[na:1.8.0_51]
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_51]
    at java.lang.reflect.Method.invoke(Method.java:497) ~[na:1.8.0_51]
    at org.springframework.messaging.handler.invocation.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:185) [spring-messaging-4.1.6.RELEASE.jar!/:4.1.6.RELEASE]
    at org.springframework.messaging.handler.invocation.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:104) [spring-messaging-4.1.6.RELEASE.jar!/:4.1.6.RELEASE]
    at org.springframework.messaging.handler.invocation.AbstractMethodMessageHandler.handleMatch(AbstractMethodMessageHandler.java:447) [spring-messaging-4.1.6.RELEASE.jar!/:4.1.6.RELEASE]
    at org.springframework.messaging.handler.invocation.AbstractMethodMessageHandler.handleMessageInternal(AbstractMethodMessageHandler.java:408) [spring-messaging-4.1.6.RELEASE.jar!/:4.1.6.RELEASE]
    at org.springframework.messaging.handler.invocation.AbstractMethodMessageHandler.handleMessage(AbstractMethodMessageHandler.java:346) [spring-messaging-4.1.6.RELEASE.jar!/:4.1.6.RELEASE]
    at org.springframework.cloud.aws.messaging.listener.SimpleMessageListenerContainer.executeMessage(SimpleMessageListenerContainer.java:160) [spring-cloud-aws-messaging-1.0.3.RELEASE.jar!/:1.0.3.RELEASE]
    at org.springframework.cloud.aws.messaging.listener.SimpleMessageListenerContainer$MessageExecutor.run(SimpleMessageListenerContainer.java:226) [spring-cloud-aws-messaging-1.0.3.RELEASE.jar!/:1.0.3.RELEASE]
    at org.springframework.cloud.aws.messaging.listener.SimpleMessageListenerContainer$SignalExecutingRunnable.run(SimpleMessageListenerContainer.java:250) [spring-cloud-aws-messaging-1.0.3.RELEASE.jar!/:1.0.3.RELEASE]
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) [na:1.8.0_51]
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) [na:1.8.0_51]
    at java.lang.Thread.run(Thread.java:745) [na:1.8.0_51]
    Suppressed: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
        ... 60 common frames omitted

我從部署了我的應用程序的機器上嘗試了curl：

curl -v https://www.remote-app/foo.pdf

響應>>>

 Trying 121.1.102.15...
    * Connected to www.remote-app (121.1.102.15) port 443 (#0)
    * Initializing NSS with certpath: sql:/etc/pki/nssdb
    *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
      CApath: none
    * NSS error -12286 (SSL_ERROR_NO_CYPHER_OVERLAP)
    * Cannot communicate securely with peer: no common encryption algorithm(s).
    * Closing connection 0
    curl: (35) Cannot communicate securely with peer: no common encryption algorithm(s).

但后來我嘗試傳遞密碼算法使用它的工作原理：

curl -v --cipher ecdhe_rsa_aes_128_gcm_sha_256 https://www.remote-app/foo.pdf

響應>>>

Trying 121.1.102.15...
200 OK...
Content...
Content...

現在我的問題是如何讓我的應用程序連接到可能具有不同ssl配置的不同SSL服務器。 因為應用程序通過ssl連接到大多數資源，但不是全部。

或者我如何支持更多可供不同服務器使用的密碼套件？ （假設這是正確的問題）

Answer 1

是的，所以我得到了解決方案。 Java附帶某些默認禁用的密碼，其中一些啟用了。 這里： https ： //docs.oracle.com/javase/8/docs/technotes/guides/security/SunProviders.html令人驚訝的是，我上面提到的所有4個密碼都在“默認啟用”表中。 但是在他們提到的密碼列表下面：

使用橢圓曲線密碼術（ECDSA，ECDH，ECDHE，ECDH_anon）的密碼套件需要符合以下要求的JCE加密提供程序：a ... b ... c ...

搜索JAVA JCE提供商將引導您訪問http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html

下載zip文件，你將在local_policy.jar中獲得兩個jar文件us_export_policy.jar

將這兩個jar文件放在ur jre jdk1.8.jdk / Contents / Home / jre / lib / security /中的security文件夾中

干杯!