ssl - javax.net.ssl、https 客户端和 close_notify

Question

使用 javax.net.ssl 和自签名证书的 https 服务器的简单 Netty 实现。服务器已启动，然后使用 DHC by Restlet 发出请求.在服务器端我得到:

io.netty.handler.ssl.SslHandler setHandshakeFailure WARNING: SSLEngine.closeInbound() raised an exception due to closed connection. javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack? at sun.security.ssl.Alerts.getSSLException(Unknown Source) at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source) at sun.security.ssl.SSLEngineImpl.closeInbound(Unknown Source) at io.netty.handler.ssl.SslHandler.setHandshakeFailure(SslHandler.java:905) at io.netty.handler.ssl.SslHandler.channelInactive(SslHandler.java:576) at io.netty.channel.DefaultChannelHandlerContext.invokeChannelInactive(DefaultChannelHandlerContext.java:819) at io.netty.channel.DefaultChannelHandlerContext.access$1300(DefaultChannelHandlerContext.java:38) at io.netty.channel.DefaultChannelHandlerContext$5.run(DefaultChannelHandlerContext.java:808) at io.netty.channel.SingleThreadEventExecutor.runAllTasks(SingleThreadEventExecutor.java:259) at io.netty.channel.nio.NioEventLoop.run(NioEventLoop.java:305) at io.netty.channel.SingleThreadEventExecutor$2.run(SingleThreadEventExecutor.java:110) at java.lang.Thread.run(Unknown Source)

在客户端:

No response. Is the certificate valid? Click here to check.

在 Chrome 的地址栏发出相同的请求，相同的服务器端异常。在 Firefox 的地址栏发出相同的异常，当 Firefox 显示其关于证书不是来自受信任的 CA 的警告页面时。 这个异常看起来很一般，并没有直接指示协议(protocol)的状态。这是否意味着这 3 个客户端(Chrome、Firefox、DHC by Restlet)没有很好地执行协议(protocol)并且只是在服务器上消失而不是发送 close_notify？还是 SSL RFC 规定的客户端行为，或者仅仅是面向安全的客户端设计？

Answer 1

我联系过DHC by Restlet团队，他们告诉了我一个解决方法:

Chrome doesn't provide an API for managing certificates. In other words, we have no API to automatically accept your certificate nor a way how to raise 'untrusted certificate' dialog. But, you can use a little workaround:

1. Open the https URL in another tab.
2. Manually accept the certificate.
3. Go back to DHC and it will work because your certificate has been accepted manually (is stored in your Chrome) by the previous step.

Usually you have to do this just once.