java ssl握手异常

Question

我知道有很多关于这个 ssl hand shake 的问题，我还是想不通。我正在尝试向 link 提交 java-ws soap 消息和终点获得了适当的证书，但为什么 java 不尊重它并给出这个众所周知的异常:

Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: 
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

当我启用网络调试时，我得到以下信息:

%% No cached client session
*** ClientHello, TLSv1
RandomCookie:  GMT: 1460059402 bytes = { 161, 121, 184, 113, 145, 191, 213, 189, 184, 72, 172, 65, 62, 227, 170, 31, 178, 118, 248, 177, 185, 159, 199, 169, 12, 109, 219, 190 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_KRB5_WITH_3DES_EDE_CBC_SHA, TLS_KRB5_WITH_3DES_EDE_CBC_MD5, TLS_KRB5_WITH_RC4_128_SHA, TLS_KRB5_WITH_RC4_128_MD5, TLS_KRB5_WITH_DES_CBC_SHA, TLS_KRB5_WITH_DES_CBC_MD5, TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA, TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5, TLS_KRB5_EXPORT_WITH_RC4_40_SHA, TLS_KRB5_EXPORT_WITH_RC4_40_MD5]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension server_name, server_name: [host_name: demo296.vertexinc.com]
***
http-bio-443-exec-2, WRITE: TLSv1 Handshake, length = 213
http-bio-443-exec-2, READ: TLSv1 Handshake, length = 49
*** ServerHello, TLSv1
RandomCookie:  GMT: 1460059402 bytes = { 87, 39, 164, 163, 199, 232, 199, 16, 238, 235, 203, 206, 70, 140, 226, 224, 163, 188, 121, 208, 109, 2, 153, 126, 2, 19, 50, 82 }
Session ID:  {}
Cipher Suite: SSL_RSA_WITH_RC4_128_SHA
Compression Method: 0
Extension renegotiation_info, renegotiated_connection: <empty>
***
%% Initialized:  [Session-2, SSL_RSA_WITH_RC4_128_SHA]
** SSL_RSA_WITH_RC4_128_SHA
http-bio-443-exec-2, READ: TLSv1 Handshake, length = 1292
*** Certificate chain
chain [0] = [
[
  Version: V3
  Subject: CN=*.vertexinc.com, OU=Vertex Inc., O=Vertex Inc, L=Berwyn, ST=Pennsylvania, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  modulus: 21011005644752221458440925799952678183823792833716434828539993186933856337574997854121938343987119300440905398000025082799836849602033704013027189447726880355089766117512592061516178819039391085455553102645007112453032938831724998233033633698493476955604784493337783750130439099745399832839029789567413380485885064049847898628887513164667338660464585157036580363609549890856904881728624134009162466528991105337058182437282700845235389976741141724118492275741871053644597590803795354460154631255971959996923189046439657231520344375967087626815565942867567333556795133804268135785335388269336344735453096564729483564909
  public exponent: 65537
  Validity: [From: Sun Nov 09 19:00:00 EST 2014,
               To: Wed Nov 09 18:59:59 EST 2016]
  Issuer: CN=GeoTrust SSL CA - G3, O=GeoTrust Inc., C=US
  SerialNumber: [    254cae2c 09b790ad ef6c356f 343deac7]

Certificate Extensions: 8
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://gn.symcd.com
, 
   accessMethod: caIssuers
   accessLocation: URIName: http://gn.symcb.com/gn.crt
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: D2 6F F7 96 F4 85 3F 72   3C 30 7D 23 DA 85 78 9B  .o....?r<0.#..x.
0010: A3 7C 5A 7C                                        ..Z.
]
]

[3]: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
  CA:false
  PathLen: undefined
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://gn.symcb.com/gn.crl]
]]

[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.16.840.1.113733.1.7.54]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 33 68 74 74 70 73 3A   2F 2F 77 77 77 2E 67 65  .3https://www.ge
0010: 6F 74 72 75 73 74 2E 63   6F 6D 2F 72 65 73 6F 75  otrust.com/resou
0020: 72 63 65 73 2F 72 65 70   6F 73 69 74 6F 72 79 2F  rces/repository/
0030: 6C 65 67 61 6C                                     legal

], PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.2
  qualifier: 0000: 30 35 0C 33 68 74 74 70   73 3A 2F 2F 77 77 77 2E  05.3https://www.
0010: 67 65 6F 74 72 75 73 74   2E 63 6F 6D 2F 72 65 73  geotrust.com/res
0020: 6F 75 72 63 65 73 2F 72   65 70 6F 73 69 74 6F 72  ources/repositor
0030: 79 2F 6C 65 67 61 6C                               y/legal

]]  ]
]

[6]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

[7]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

[8]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: *.vertexinc.com
  DNSName: vertexinc.com
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 8B 63 CB B1 74 E3 15 E8   24 1D C9 31 DF 0B A5 F2  .c..t...$..1....
0010: 04 72 FF 9A CD E0 AD 36   4B E1 C6 2C 02 39 BB C2  .r.....6K..,.9..
0020: CB 8C CE BE 60 EF 59 59   7E 20 47 90 47 9A 10 35  ....`.YY. G.G..5
0030: C4 1C 96 3D 11 7C C0 1D   02 E5 E8 32 FC 2E E8 E5  ...=.......2....
0040: 17 DB 52 70 C1 79 38 1B   9E 4F CF 8E 09 5B 96 EB  ..Rp.y8..O...[..
0050: F9 FB DD 66 33 17 53 32   C7 37 AA 1D D1 84 05 D6  ...f3.S2.7......
0060: 53 84 CA AB 5F E7 DB 0E   12 F6 82 A9 24 7A ED 3C  S..._.......$z.<
0070: ED CC 5C 77 8D 0B D3 FD   FD FA 6A 8B 34 C3 E1 2E  ..\w......j.4...
0080: FB D8 31 B9 A1 5C BD 63   FD 66 01 00 69 D2 8A 13  ..1..\.c.f..i...
0090: 99 08 84 66 97 65 93 93   27 B7 70 A0 07 01 4F AD  ...f.e..'.p...O.
00A0: 5C B4 BB 79 18 18 50 CD   64 85 38 9E 5C 39 20 FB  \..y..P.d.8.\9 .
00B0: A3 C4 97 7C 65 9F 53 ED   25 D3 7A 02 08 BC DB 28  ....e.S.%.z....(
00C0: 09 F1 12 62 D7 9E 21 22   BF 36 B3 66 35 77 1C 6D  ...b..!".6.f5w.m
00D0: EE E8 67 F2 49 A9 6A B1   1B B8 70 63 09 19 F2 71  ..g.I.j...pc...q
00E0: 7C BD 6C 70 5B C1 FE 17   1A E4 80 26 55 7F F1 1D  ..lp[......&U...
00F0: BF 57 38 D2 34 49 80 13   5B DB 1F 16 C1 A6 A8 82  .W8.4I..[.......

]
***
%% Invalidated:  [Session-2, SSL_RSA_WITH_RC4_128_SHA]
http-bio-443-exec-2, SEND TLSv1 ALERT:  fatal, description = certificate_unknown
http-bio-443-exec-2, WRITE: TLSv1 Alert, length = 2
http-bio-443-exec-2, called closeSocket()
http-bio-443-exec-2, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

从端点可以看出，证书链来自权威机构。

screenshot

GeoTrust Global CA 是根链并包含在默认的 jdk cacerts 中。我在想如果根发行者是可信的并且在 cacerts 中那么 java 应该尊重它，但它没有。然后第二个 cacerts 链 GeoTrust SSL CA - G3 不存在，我导入了它。仍然没有用。我可以导入整个证书链，但为什么在这种情况下 java 不接受受信任的授权？

谢谢!

Answer 1

根据 SSLLabs证书链不完整，需要“额外下载”。所以我觉得您在导入更多链条方面走在正确的轨道上。

此外，它不支持 TLS 1.2 - 实际上，iOS9 似乎也无法连接。我知道这不是您的证书，但可能是因为 Java 对这里的证书有些挑剔。