java - 需要帮助解决 javax.net.ssl.SSLPeerUnverifiedException

Question

我正在使用 Apache httpcomponents 4.2.5 构建一个简单的 https 客户端以从服务器获取文件。

该代码主要基于 ClientExecuteProxy.java示例代码。我在Java 1.6.0_31下开发并测试了客户端，它按预期工作。

我将最终的 jar 分发到我的一台具有 Java 1.7.0_25 的服务器(大约 2 周前奇迹般地安装了)。在 Java 7 下，我收到错误。

我尝试了多种开关，通过 Firefox 访问该网站，单击锁并下载证书/添加到 cacerts。这在下面的调试日志中得到了验证，请注意，在 java 6 下没有它它也可以工作。我继续获得相同的堆栈跟踪。

Exception in thread "main" javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
    at sun.security.ssl.SSLSessionImpl.getPeerCertificates(Unknown Source)
    at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:126)
    at org.apache.http.conn.ssl.SSLSocketFactory.createLayeredSocket(SSLSocketFactory.java:493)
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.updateSecureConnection(DefaultClientConnectionOperator.java:232)
    at org.apache.http.impl.conn.ManagedClientConnectionImpl.layerProtocol(ManagedClientConnectionImpl.java:401)
    at org.apache.http.impl.client.DefaultRequestDirector.establishRoute(DefaultRequestDirector.java:840)
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:647)
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:479)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:906)
    at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:827)

打开 javax 调试选项并查看其他人发布的内容...

    executing request to https://dmf.ntis.gov:443 via http://myproxy.mynet:8080
trustStore is: C:\Program Files\Java\jre7\lib\security\cacerts
trustStore type is : jks
trustStore provider is : 
init truststore

...

adding as trusted cert:
  Subject: CN=dmf.ntis.gov, O=National Technical Information Service, L=Alexandria, ST=Virginia, C=US
  Issuer:  CN=Entrust Certification Authority - L1C, OU="(c) 2009 Entrust, Inc.", OU=www.entrust.net/rpa is incorporated by reference, O="Entrust, Inc.", C=US
  Algorithm: RSA; Serial number: 0x4c1ed933
  Valid from Fri Jan 25 10:23:19 EST 2013 until Sun Jan 26 22:54:05 EST 2014

...

trigger seeding of SecureRandom
done seeding SecureRandom
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: true
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
%% No cached client session
*** ClientHello, TLSv1
RandomCookie:  GMT: 1355254829 bytes = { 151, 204, 236, 54, 121, 42, 132, 221, 43, 116, 69, 16, 51, 17, 65, 109, 23, 135, 125, 16, 54, 72, 163, 189, 169, 189, 114, 223 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension server_name, server_name: [host_name: dmf.ntis.gov]
***
[write] MD5 and SHA1 hashes:  len = 170
0000: 01 00 00 A6 03 01 51 C8   8C 2D 97 CC EC 36 79 2A  ......Q..-...6y*
0010: 84 DD 2B 74 45 10 33 11   41 6D 17 87 7D 10 36 48  ..+tE.3.Am....6H
0020: A3 BD A9 BD 72 DF 00 00   2A C0 09 C0 13 00 2F C0  ....r...*...../.
0030: 04 C0 0E 00 33 00 32 C0   07 C0 11 00 05 C0 02 C0  ....3.2.........
0040: 0C C0 08 C0 12 00 0A C0   03 C0 0D 00 16 00 13 00  ................
0050: 04 00 FF 01 00 00 53 00   0A 00 34 00 32 00 17 00  ......S...4.2...
0060: 01 00 03 00 13 00 15 00   06 00 07 00 09 00 0A 00  ................
0070: 18 00 0B 00 0C 00 19 00   0D 00 0E 00 0F 00 10 00  ................
0080: 11 00 02 00 12 00 04 00   05 00 14 00 08 00 16 00  ................
0090: 0B 00 02 01 00 00 00 00   11 00 0F 00 00 0C 64 6D  ..............dm
00A0: 66 2E 6E 74 69 73 2E 67   6F 76                    f.ntis.gov
main, WRITE: TLSv1 Handshake, length = 170
[Raw write]: length = 175
0000: 16 03 01 00 AA 01 00 00   A6 03 01 51 C8 8C 2D 97  ...........Q..-.
0010: CC EC 36 79 2A 84 DD 2B   74 45 10 33 11 41 6D 17  ..6y*..+tE.3.Am.
0020: 87 7D 10 36 48 A3 BD A9   BD 72 DF 00 00 2A C0 09  ...6H....r...*..
0030: C0 13 00 2F C0 04 C0 0E   00 33 00 32 C0 07 C0 11  .../.....3.2....
0040: 00 05 C0 02 C0 0C C0 08   C0 12 00 0A C0 03 C0 0D  ................
0050: 00 16 00 13 00 04 00 FF   01 00 00 53 00 0A 00 34  ...........S...4
0060: 00 32 00 17 00 01 00 03   00 13 00 15 00 06 00 07  .2..............
0070: 00 09 00 0A 00 18 00 0B   00 0C 00 19 00 0D 00 0E  ................
0080: 00 0F 00 10 00 11 00 02   00 12 00 04 00 05 00 14  ................
0090: 00 08 00 16 00 0B 00 02   01 00 00 00 00 11 00 0F  ................
00A0: 00 00 0C 64 6D 66 2E 6E   74 69 73 2E 67 6F 76     ...dmf.ntis.gov
main, handling exception: java.net.SocketException: Connection reset
main, SEND TLSv1 ALERT:  fatal, description = unexpected_message
main, WRITE: TLSv1 Alert, length = 2
main, Exception sending alert: java.net.SocketException: Connection reset by peer: socket write error
main, called closeSocket()
main, IOException in getSession():  java.net.SocketException: Connection reset

抱歉，这里的帖子很长。该日志是使用 -Dsun.security.ssl.allowUnsafeRenegotiation=true 开关生成的，但没有任何区别。

代码有一些自定义类，但这里没有魔法。配置位于属性文件中并在运行时加载，参数应该非常不言自明。

    private static void getHttpFile(HttpContextConfig cfg,
        HttpContextEntry ctx, 
        String remoteFile, 
        String localFile, 
        Boolean useTemp) throws Exception {


    SimpleDateFormat sdf = new SimpleDateFormat("dd-MMM-yyyy HH:mm:ss.SSS");
    System.out.println("\n\n" + sdf.format(new Date()) +  " HttpClientUtil Starting...");

    DefaultHttpClient httpclient = new DefaultHttpClient();
    // socket.setEnabledProtocols(new String[] { "SSLv3" }); 
    try {
        HttpHost target = new HttpHost(ctx.getHostName(), 
                Integer.parseInt(ctx.getPort()), 
                ctx.getScheme());

        if (null != cfg.getProxyHost()){
            HttpHost proxy = new HttpHost(cfg.getProxyHost(), 
                    cfg.getProxyPort(), 
                    cfg.getProxyScheme());

            httpclient.getParams().setParameter(ConnRoutePNames.DEFAULT_PROXY, proxy);
            System.out.println("executing request to " + target + " via " + proxy);
        }
        else
            System.out.println("executing request to " + target);

        // Set the credentials if we have a userID
        if (null != ctx.getUserName()){
            httpclient.getCredentialsProvider().setCredentials(
                    new AuthScope(ctx.getHostName(), Integer.parseInt(ctx.getPort())),
                    new UsernamePasswordCredentials(ctx.getUserName(), ctx.getPassword()));
        }


        HttpGet req = new HttpGet(remote);

        HttpResponse rsp = httpclient.execute(target, req);
        HttpEntity entity = rsp.getEntity();

        System.out.println("----------------------------------------");
        System.out.println(rsp.getStatusLine());
        Header[] headers = rsp.getAllHeaders();
        for (int i = 0; i<headers.length; i++) {
            System.out.println(headers[i]);
        }
        System.out.println("----------------------------------------");

        System.out.println("\n\t" + sdf.format(new Date()) +  " Writing Output to File: " + local );

            *** Snipped some unimportant code out ***

            OutputStream OutStream = new FileOutputStream(local);

            entity.writeTo(OutStream);
            OutStream.flush();
            OutStream.close();

    } finally {
        // When HttpClient instance is no longer needed,
        // shut down the connection manager to ensure
        // immediate deallocation of all system resources
        httpclient.getConnectionManager().shutdown();
    }
}

我一直在研究各种线索，试图找出答案。我不想禁用(接受所有证书)解决方案。我还没有尝试使用自定义 SSL 套接字工厂来显式设置 SSLv3 协商。

socket.setEnabledProtocols(new String[] { "SSLv3" });

该站点确实有用户 ID 和密码来下载数据，并且确实有 cookie，但同样，这在 JRE 6 下确实有效。

感谢您提供的任何帮助。

Answer 1

这个问题的答案最终有很多。

1. 生产服务器使用 WPAD(Web 代理自动发现)代理查找。我使用的是可访问的代理，但无法访问确实针对我正在使用的主机进行了配置。我最终使用了proxy-vole以避免在属性文件中硬编码代理服务器。

2. Java 7 更改了 httpclient 的行为。我将 JRE 7 从生产主机复制到本地电脑，并受到来自代理服务器的身份验证的挑战。 JRE 6 中没有发生这种情况。在 Windows 环境中，我通过使用 NTLM 代理身份验证解决了此问题

DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.getAuthSchemes().register("ntlm", new NTLMSchemeFactory());

奇怪的是，直到我针对有效的代理服务器/主机组合运行代码后，我才发现代理身份验证问题。我确信这是一个配置问题，但代理服务器返回了一个具有正确配置的未经身份验证的页面。在我的生产服务器上，我刚刚断开了套接字。

不幸的是，这只是这 30,000 个 footer 错误之一，而这些错误似乎有很多根本原因。