java - SSLHandshakeException 致命警报 : handshake_failure

Question

可以看成是重复的问题。我已经遍历了与此问题相关的所有可能的 stackoverflow 线程，并且尝试了所有解决方案但没有运气。实际上，应用程序正在使用 httpclient-4.3.4.jar 并在 java 6 上运行。我们不能在 java 8 上移动应用程序。我附上了 调试级别日志。服务器的 SSL 证书 显示 使用强协议(protocol) (TLS 1.2)、强 key 交换 (ECDHE_ECDSA) 和强密码 (AES_128_GCM) 对该站点的连接进行加密和验证。

Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is secure renegotiation: false
%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1500422464 bytes = { 244, 1, 120, 102, 154, 157, 165, 201, 76, 12, 37, 6, 102, 104, 27, 126, 218, 227, 252, 79, 141, 224, 3, 232, 45, 196, 255, 209 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
***
0000: 01 00 00 C1 03 03 59 6F   A1 40 F4 01 78 66 9A 9D  ......Yo.@..xf..
0010: A5 C9 4C 0C 25 06 66 68   1B 7E DA E3 FC 4F 8D E0  ..L.%.fh.....O..
0020: 03 E8 2D C4 FF D1 00 00   3A C0 23 C0 27 00 3C C0  ..-.....:.#.'.<.
0030: 25 C0 29 00 67 00 40 C0   09 C0 13 00 2F C0 04 C0  %.).g.@...../...
0040: 0E 00 33 00 32 C0 2B C0   2F 00 9C C0 2D C0 31 00  ..3.2.+./...-.1.
0050: 9E 00 A2 C0 08 C0 12 00   0A C0 03 C0 0D 00 16 00  ................
0060: 13 00 FF 01 00 00 5E 00   0A 00 34 00 32 00 17 00  ......^...4.2...
0070: 01 00 03 00 13 00 15 00   06 00 07 00 09 00 0A 00  ................
0080: 18 00 0B 00 0C 00 19 00   0D 00 0E 00 0F 00 10 00  ................
0090: 11 00 02 00 12 00 04 00   05 00 14 00 08 00 16 00  ................
00A0: 0B 00 02 01 00 00 0D 00   1C 00 1A 06 03 06 01 05  ................
00B0: 03 05 01 04 03 04 01 04   02 03 03 03 01 03 02 02  ................
00C0: 03 02 01 02 02
http-bio-9090-exec-5, WRITE: TLSv1.2 Handshake, length = 197
[Raw write]: length = 202
0000: 16 03 03 00 C5 01 00 00   C1 03 03 59 6F A1 40 F4  ...........Yo.@.
0010: 01 78 66 9A 9D A5 C9 4C   0C 25 06 66 68 1B 7E DA  .xf....L.%.fh...
0020: E3 FC 4F 8D E0 03 E8 2D   C4 FF D1 00 00 3A C0 23  ..O....-.....:.#
0030: C0 27 00 3C C0 25 C0 29   00 67 00 40 C0 09 C0 13  .'.<.%.).g.@....
0040: 00 2F C0 04 C0 0E 00 33   00 32 C0 2B C0 2F 00 9C  ./.....3.2.+./..
0050: C0 2D C0 31 00 9E 00 A2   C0 08 C0 12 00 0A C0 03  .-.1............
0060: C0 0D 00 16 00 13 00 FF   01 00 00 5E 00 0A 00 34  ...........^...4
0070: 00 32 00 17 00 01 00 03   00 13 00 15 00 06 00 07  .2..............
0080: 00 09 00 0A 00 18 00 0B   00 0C 00 19 00 0D 00 0E  ................
0090: 00 0F 00 10 00 11 00 02   00 12 00 04 00 05 00 14  ................
00A0: 00 08 00 16 00 0B 00 02   01 00 00 0D 00 1C 00 1A  ................
00B0: 06 03 06 01 05 03 05 01   04 03 04 01 04 02 03 03  ................
00C0: 03 01 03 02 02 03 02 01   02 02                    ..........
[Raw read]: length = 5
0000: 15 03 01 00 02 
[Raw read]: length = 2
0000: 02 28
http-bio-9090-exec-5, READ: TLSv1 Alert, length = 2
http-bio-9090-exec-5, RECV TLSv1.2 ALERT:  fatal, handshake_failure
http-bio-9090-exec-5, called closeSocket()
http-bio-9090-exec-5, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

我按照下面提到的不同方法创建 SSLContext。

方法一:

TrustManager[] trustAllCerts = new TrustManager[] {new X509TrustManager() {
            public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                return null;
            }
            public void checkClientTrusted(X509Certificate[] certs, String authType) {
            }
            public void checkServerTrusted(X509Certificate[] certs, String authType) {
            }
        }
    };
try
{
   SSLContext sc = SSLContext.getInstance("SSL");
   sc.init(null, trustAllCerts, new java.security.SecureRandom());
   HostnameVerifier allHostsValid = new HostnameVerifier() {
   public boolean verify(String hostname, SSLSession session) {
       return true;
   }
};
   HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
} catch (Exception e) {
    logger.info("SOAP SSL Config failed ::: "+e);
}

方法 2:

SSLContext sslContext = SSLContexts.createSystemDefault();
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext,SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
int port = Integer.parseInt(tr.getSupplierSettings().get(PROXY_PORT));
CredentialsProvider credsProvider = new BasicCredentialsProvider();
credsProvider.setCredentials(new AuthScope(tr.getSupplierSettings().get(PROXY_SUPPLIER_HOST), port),
            new UsernamePasswordCredentials(tr.getSupplierSettings().get(PROXY_SUPPLIER_USERNAME),
                    tr.getSupplierSettings().get(PROXY_SUPPLIER_PASSWORD)));
CloseableHttpClient httpclient = HttpClients.custom().setDefaultCredentialsProvider(credsProvider)
            .setSSLSocketFactory(sslsf).build();

PROXY_SUPPLIER_HOST、PROXY_PORT、PROXY_SUPPLIER_USERNAME 和 PROXY_SUPPLIER_PASSWORD 是常量。我尝试了其他线程中提到的其他方法。我也尝试过不使用 proxy settings。我希望有人可以阅读上面提到的日志并帮助我解决这个问题。

Answer 1

正如我们在评论部分看到的，我尝试将 Bouncy provider 添加到 Security。 Bouncy Provider 信息可用here.我添加了 Security.addProvider(new BouncyCaSTLeProvider());。我添加了 maven 依赖项，如下所述。

<dependency>
    <groupId>org.bouncycastle</groupId>
    <artifactId>bcprov-debug-jdk15on</artifactId>
    <version>1.52</version>
</dependency>

所有功劳归功于@dave_thompson_085