java - 当服务器不支持 TLS 1.0 时，带有目标的 HCP JEE6 应用程序失败

Question

我们正在使用 Hana Cloud Platform Java 应用程序外部的 RESTful 服务。我们能够通过作为应用程序 JEE6 配置文件和其他 HCP 库的一部分提供的 Apache HttpClient (v4.1.3) 与 HCP 中设置的这些目标进行交互，该应用程序配置为使用 JRE 7。

我们连接的集成基础架构供应商最近禁用了 TLSv1.0，从那时起我们在尝试连接 REST 服务时遇到错误。

这是堆栈跟踪:

javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
at sun.security.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:421)
at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:397)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:150)
at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:575)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
at com.sap.core.connectivity.httpdestination.client.RequestDirectorExtender.execute(RequestDirectorExtender.java:47)
at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820)
at com.sap.core.connectivity.httpdestination.impl.AbstractHttpClientWrapper$2.execute(AbstractHttpClientWrapper.java:141)
at com.sap.core.connectivity.httpdestination.impl.AbstractHttpClientWrapper$2.execute(AbstractHttpClientWrapper.java:1)
at com.sap.core.connectivity.httpdestination.impl.AbstractHttpClientWrapper.executeOperation(AbstractHttpClientWrapper.java:300)
at com.sap.core.connectivity.httpdestination.impl.AbstractHttpClientWrapper.execute(AbstractHttpClientWrapper.java:277)
at com.sap.core.connectivity.httpdestination.impl.AbstractHttpClientWrapper.execute(AbstractHttpClientWrapper.java:132)
at com.sap.core.connectivity.httpdestination.impl.AbstractHttpClientWrapper.execute(AbstractHttpClientWrapper.java:126)
at my.domain.hcp.HttpRequestSupport.service(HttpRequestSupport.java:124)
at my.domain.gap.proxy.ProxyServlet.service(ProxyServlet.java:36)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:848)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:303)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at com.sap.core.communication.server.CertValidatorFilter.doFilter(CertValidatorFilter.java:156)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:241)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:208)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:218)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:122)
at org.eclipse.virgo.web.enterprise.security.valve.OpenEjbSecurityInitializationValve.invoke(OpenEjbSecurityInitializationValve.java:44)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:614)
at com.sap.core.jpaas.security.auth.service.lib.AbstractAuthenticator.invoke(AbstractAuthenticator.java:170)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:169)
at org.apache.catalina.valves.AccessLogValve.invoke(AccessLogValve.java:956)
at com.sap.core.tenant.valve.TenantValidationValve.invokeNextValve(TenantValidationValve.java:168)
at com.sap.core.tenant.valve.TenantValidationValve.invoke(TenantValidationValve.java:94)
at com.sap.js.statistics.tomcat.valve.RequestTracingValve.invoke(RequestTracingValve.java:38)
at com.sap.core.js.monitoring.tomcat.valve.RequestTracingValve.invoke(RequestTracingValve.java:27)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:103)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:116)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:442)
at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1083)
at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:640)
at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:316)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.lang.Thread.run(Thread.java:807)

我们已尝试将 JVM 参数添加到 Java 应用程序以强制它使用 TLSv1.1 或 TLSv1.2 而不是使用 TLSv1.0:

-Dhttps.protocols=TLSv1.1,TLSv1.2

设置 JVM 参数没有任何作用，Apache HttpClient 库似乎忽略了此设置。是否有另一种方法可以强制 Apache HttpClient (v4.1.3) 使用更新版本的 TLS？

Answer 1

事实证明，可以扩展类 org.apache.http.conn.ssl.SSLSocketFactory 并将其注册到 HttpClient 以强制客户端使用特定协议(protocol)。事实上，您可以使用相同的机制来更改密码、超时等。

添加此附加代码以从 HttpDestination 创建 HttpClient:

private static final String CA_CERTS_PATH = System.getProperties().getProperty("java.home") + File.separator +
        "lib" + File.separator + "security" + File.separator + "cacerts";

private HttpClient createHttpClient(HttpDestination httpDestination)
        throws DestinationException, KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException, KeyManagementException {

    HttpClient httpClient = httpDestination.createHttpClient();
    try (FileInputStream fis = new FileInputStream(CA_CERTS_PATH)) {
        KeyStore keyStore = KeyStore.getInstance("JKS");
        keyStore.load(fis, "changeit".toCharArray());

        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(keyStore);

        SSLContext ctx = SSLContext.getInstance("TLS");
        ctx.init(null, tmf.getTrustManagers(), new SecureRandom());

        // Instantiate the custom SSLSocketFactory
        SSLSocketFactory sslSocketFactory = new CustomSSLSocketFactory(
                ctx,
                SSLSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER,
                new String[]{"TLSv1.1", "TLSv1.2"}
        );

        // Register the https scheme with the custom SSLSocketFactory
        Scheme httpsScheme = new Scheme("https", 443, sslSocketFactory);
        httpClient.getConnectionManager().getSchemeRegistry().register(httpsScheme);
    }
    return httpClient;
}

并扩展 SSLSocketFactory 类:

import org.apache.http.conn.ssl.SSLSocketFactory;
import org.apache.http.conn.ssl.X509HostnameVerifier;
import org.apache.http.params.HttpParams;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import java.io.IOException;
import java.net.InetAddress;
import java.net.InetSocketAddress;
import java.net.Socket;

/**
 * Custom SSLSocketFactory to limit connections to specific TLS protocols.
 *
 * @author Juan Heyns
 */
public class CustomSSLSocketFactory extends SSLSocketFactory {

    private final String[] tlsProtocols;

    public CustomSSLSocketFactory(SSLContext sslContext, X509HostnameVerifier hostnameVerifier, String[] tlsProtocols) {
        super(sslContext, hostnameVerifier);
        this.tlsProtocols = tlsProtocols;
    }

    @Override
    public Socket connectSocket(Socket socket, InetSocketAddress remoteAddress, InetSocketAddress localAddress, HttpParams params) throws IOException {
        return prepareSocket(super.connectSocket(socket, remoteAddress, localAddress, params));
    }

    @Override
    public Socket createLayeredSocket(Socket socket, String host, int port, boolean autoClose) throws IOException {
        return prepareSocket(super.createLayeredSocket(socket, host, port, autoClose));
    }

    @Override
    public Socket createSocket(HttpParams params) throws IOException {
        return prepareSocket(super.createSocket(params));
    }

    @Override
    @Deprecated
    public Socket createSocket() throws IOException {
        return prepareSocket(super.createSocket());
    }

    @Override
    @Deprecated
    public Socket createSocket(Socket socket, String host, int port, boolean autoClose) throws IOException {
        return prepareSocket(super.createSocket(socket, host, port, autoClose));
    }

    @Override
    @Deprecated
    public Socket connectSocket(Socket socket, String host, int port, InetAddress localAddress, int localPort, HttpParams params) throws IOException {
        return prepareSocket(super.connectSocket(socket, host, port, localAddress, localPort, params));
    }

    /**
     * Any socket returned from this class will first be configured.
     *
     * @param socket
     * @return
     */
    private Socket prepareSocket(Socket socket) {
        if (socket instanceof SSLSocket) {
            SSLSocket sslSocket = (SSLSocket) socket;
            sslSocket.setEnabledProtocols(tlsProtocols);
        }
        return socket;
    }

}