java - Websphere 8.5 上的 SSL handshake_failure(在 Tomcat 上工作)

Question

长话短说；有什么原因导致在 Tomcat 上运行的应用程序无法与 Paypal 服务器通信？一些背景:我们正在 Liferay 上开发一系列 portlet，它们在某些时候与 paypal 服务器通信以启动和验证购买流程。这在没有任何特殊配置的情况下就像本地 tomcat 上的魅力一样工作，但是在安装 Liferay 和 portlet 之后它无法启动该过程。堆栈看起来像这样:

[16/12/14 13:51:01:728 GMT+01:00] 0000015d SystemOut     O 13:51:01,727 ERROR [WebContainer : 2][render_portlet_jsp:132] null
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at com.ibm.jsse2.o.a(o.java:33)
    at com.ibm.jsse2.o.a(o.java:30)
    at com.ibm.jsse2.SSLSocketImpl.b(SSLSocketImpl.java:168)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:318)
    at com.ibm.jsse2.SSLSocketImpl.h(SSLSocketImpl.java:403)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:431)
    at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:315)
    at com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:103)
    at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:42)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1184)
    at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:390)
    at com.ibm.net.ssl.www2.protocol.https.b.getResponseCode(b.java:82)
    at com.paypal.core.HttpConnection.execute(HttpConnection.java:93)
    at com.paypal.core.APIService.makeRequestUsing(APIService.java:176)
    at com.paypal.core.BaseService.call(BaseService.java:265)
    at urn.ebay.api.PayPalAPI.PayPalAPIInterfaceServiceService.setExpressCheckout(PayPalAPIInterfaceServiceService.java:2196)
    at urn.ebay.api.PayPalAPI.PayPalAPIInterfaceServiceService.setExpressCheckout(PayPalAPIInterfaceServiceService.java:2148)

我一直在“谷歌搜索”，但无法弄清楚错误可能出在哪里。我们已尝试注册签名者从 paypal 站点检索到的 Verisign 证书，但没有任何改变。

有人可以为我们指明正确的方向吗？谢谢!

---

更新提高网络日志记录级别后，我可以在日志中看到以下内容:

     O class com.ibm.websphere.ssl.protocol.SSLSocketFactory is loaded
     O instantiated an instance of class com.ibm.websphere.ssl.protocol.SSLSocketFactory
     O 
handshake: true
     O Ignoring unsupported cipher suite: SSL_RSA_WITH_AES_128_CBC_SHA
     O Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_128_CBC_SHA
     O Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_128_CBC_SHA
     O %% No cached client session
     O *** ClientHello, SSLv3
     O RandomCookie:  GMT: 1402031796 bytes = { 166, 100, 171, 183, 214, 31, 12, 68, 124, 68, 151, 195, 7, 4, 28, 112, 39, 90, 248, 143, 129, 106, 212, 33, 244, 40, 233, 94 }
     O Session ID:  {}
     O Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_RC4_128_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RENEGO_PROTECTION_REQUEST]
     O Compression Methods:  { 0 }
     O ***
     O [write] MD5 and SHA1 hashes:  len = 75
     O 0000: 01 00 00 47 03 00 54 91  4f b4 a6 64 ab b7 d6 1f  ...G..T.O..d....
0010: 0c 44 7c 44 97 c3 07 04  1c 70 27 5a f8 8f 81 6a  .D.D.....p.Z...j
0020: d4 21 f4 28 e9 5e 00 00  20 00 04 00 05 00 0a fe  ................
0030: ff 00 16 00 13 00 66 00  09 fe fe 00 15 00 12 00  ......f.........
0040: 03 00 08 00 14 00 11 00  ff 01 00                 ...........

     O WebContainer : 10, WRITE: SSLv3 Handshake, length = 75
     O [Raw write]: length = 80
     O 0000: 16 03 00 00 4b 01 00 00  47 03 00 54 91 4f b4 a6  ....K...G..T.O..
0010: 64 ab b7 d6 1f 0c 44 7c  44 97 c3 07 04 1c 70 27  d.....D.D.....p.
0020: 5a f8 8f 81 6a d4 21 f4  28 e9 5e 00 00 20 00 04  Z...j...........
0030: 00 05 00 0a fe ff 00 16  00 13 00 66 00 09 fe fe  ...........f....
0040: 00 15 00 12 00 03 00 08  00 14 00 11 00 ff 01 00  ................

     O [Raw read]: length = 5
     O 0000: 15 03 00 00 02                                     .....

     O [Raw read]: length = 2
     O 0000: 02 28                                              ..

     O WebContainer : 10, READ: SSLv3 Alert, length = 2
     O WebContainer : 10, RECV TLSv1 ALERT:  fatal, handshake_failure
     O WebContainer : 10, called closeSocket()
     O WebContainer : 10, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
     O 
handshake: true
     O Ignoring unsupported cipher suite: SSL_RSA_WITH_AES_128_CBC_SHA
     O Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_128_CBC_SHA
     O Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_128_CBC_SHA
     O %% No cached client session
     O *** ClientHello, SSLv3
     O RandomCookie:  GMT: 1402031797 bytes = { 153, 95, 153, 155, 68, 36, 152, 92, 71, 172, 226, 104, 156, 107, 235, 73, 63, 239, 198, 202, 166, 216, 158, 26, 45, 59, 169, 169 }
     O Session ID:  {}
     O Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_RC4_128_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RENEGO_PROTECTION_REQUEST]
     O Compression Methods:  { 0 }
     O ***
     O [write] MD5 and SHA1 hashes:  len = 75
     O 0000: 01 00 00 47 03 00 54 91  4f b5 99 5f 99 9b 44 24  ...G..T.O.....D.
0010: 98 5c 47 ac e2 68 9c 6b  eb 49 3f ef c6 ca a6 d8  ..G..h.k.I......
0020: 9e 1a 2d 3b a9 a9 00 00  20 00 04 00 05 00 0a fe  ................
0030: ff 00 16 00 13 00 66 00  09 fe fe 00 15 00 12 00  ......f.........
0040: 03 00 08 00 14 00 11 00  ff 01 00                 ...........

     O WebContainer : 10, WRITE: SSLv3 Handshake, length = 75
     O [Raw write]: length = 80
     O 0000: 16 03 00 00 4b 01 00 00  47 03 00 54 91 4f b5 99  ....K...G..T.O..
0010: 5f 99 9b 44 24 98 5c 47  ac e2 68 9c 6b eb 49 3f  ...D...G..h.k.I.
0020: ef c6 ca a6 d8 9e 1a 2d  3b a9 a9 00 00 20 00 04  ................
0030: 00 05 00 0a fe ff 00 16  00 13 00 66 00 09 fe fe  ...........f....
0040: 00 15 00 12 00 03 00 08  00 14 00 11 00 ff 01 00  ................

     O [Raw read]: length = 5
     O 0000: 15 03 00 00 02                                     .....

     O [Raw read]: length = 2
     O 0000: 02 28                                              ..

     O WebContainer : 10, READ: SSLv3 Alert, length = 2
     O WebContainer : 10, RECV TLSv1 ALERT:  fatal, handshake_failure
     O WebContainer : 10, called closeSocket()
     O WebContainer : 10, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
     O 10:41:09,593 ERROR [WebContainer : 10][PaypalUtils:145] Errores en setPaypalExpressCheckout
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at com.ibm.jsse2.o.a(o.java:33)
    at com.ibm.jsse2.o.a(o.java:30)

服务器控制台配置的SSL协议(protocol)为TLS。

Answer 1

通常在 Websphere 中，您需要导入要与之通信的服务器的证书。如果您手动尝试，您可能不会在链中导入适当的证书，而是在管理控制台中使用“从端口检索”。

另一种选择是，由于 Poodle 问题，Paypal 正在终止 SSL :)。在这种情况下，在管理控制台的安全菜单中将您的安全级别提高到 TLS