algorithm - OpenJDK :javax.net.ssl.SSLHandshakeException : java. security.cert.CertificateException: 证书不符合算法约束

Question

我在 jetty 中使用 OpenJDK1.8.0 的 Web 服务尝试建立到 Microsoft 服务器的 HTTPS 连接，但出现此错误:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates does not conform to algorithm constraints
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:914)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747)
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:828)
at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2116)
at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096)
at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398)
at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323)
......

信任 Microsoft 服务器的证书看起来不错:

• 公钥:RSA(2048 位)
• 签名算法:sha256RSA

• 签名哈希算法:sha256没有算法匹配 jre_path/lib/security/java.security disableAlgorithm:

  jdk.certpath.disabledAlgorithms=MD2, MD5, RSA keySize < 1024jdk.tls.disabledAlgorithms=SSLv3, RC4, MD5withRSA, DH keySize < 768

我检查了 jetty 和 Microsoft 中的 TLS Cipher Suite 支持，一切正常:

• TLS1_1:ECDHE-RSA-AES256-SHA
• TLS1_2:ECDHE-RSA-AES256-SHA384
• TLS1:ECDHE-RSA-AES256-SHA

我的问题:

1. 是什么导致“证书不符合算法约束”异常？
2. 据我所知，OpenJDK 支持无限强度加密，无需额外的策略文件。我是否遗漏了什么？

谢谢!

Answer 1

由于Windows server使用的证书中的signature algorithm采用了 future 的TLSv1.3标准的算法，所以OpenJDK抛出了这个异常。