java - 使用 TLSv1.2 从 java 连接到 cloudant

Question

我正在尝试使用运行 IBM JRE 的 Liberty 服务器中的 TLSv1.2 从 Java 连接到我的 Cloudant 数据库。

对低于 TLSv1.2 的连接的支持即将结束，我需要此工作。

我向配置为 TLSv1.2 通信的构建器添加了一个 customSSLSocketFactory ，当我在本地环境(在 Oracle JRE 上运行)中运行它时，没有错误，但是当我在较新的环境，使用 IBM JRE(最新版本 Java 8)运行 Liberty 服务器时出现错误。

SSLSocketFactory sslSocketFactory; 
try {
    TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    trustManagerFactory.init((KeyStore) null);
    TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
    if (trustManagers.length != 1 || !(trustManagers[0] instanceof X509TrustManager)) {
        throw new IllegalStateException("Unexpected default trust managers:" + Arrays.toString(trustManagers));
    }
    X509TrustManager trustManager = (X509TrustManager) trustManagers[0];

    SSLContext ssl = SSLContext.getInstance("TLSv1.2");
    ssl.init(null, new TrustManager[] { trustManager }, new SecureRandom());
    sslSocketFactory = ssl.getSocketFactory();
} catch (GeneralSecurityException e) {
    throw new RuntimeException(e);
}

client = ClientBuilder.url(new URL(restServerURL)).username(userid)
         .password(password).connectTimeout(60, TimeUnit.SECONDS).customSSLSocketFactory(sslSocketFactory)
         .build();

收到的错误是:

R java.lang.IllegalStateException: Unable to extract the trust manager on okhttp3.internal.platform.Platform@5194035f, sslSocketFactory is class com.ibm.jsse2.SSLSocketFactoryImpl
R   at okhttp3.OkHttpClient$Builder.sslSocketFactory(OkHttpClient.java:654)
R   at okhttp3.internal.huc.OkHttpsURLConnection.setSSLSocketFactory(OkHttpsURLConnection.java:63)
R   at com.cloudant.http.internal.interceptors.SSLCustomizerInterceptor.interceptRequest(SSLCustomizerInterceptor.java:71)
R   at com.cloudant.http.HttpConnection.execute(HttpConnection.java:290)
R   at com.cloudant.client.org.lightcouch.CouchDbClient.execute(CouchDbClient.java:485)
R   at com.cloudant.client.api.CloudantClient.executeRequest(CloudantClient.java:339)
R   at com.cloudant.client.internal.views.ViewRequester.executeRequestWithResponseAsJson(ViewRequester.java:34)
R   at com.cloudant.client.internal.views.ViewRequester.getResponseAsJson(ViewRequester.java:28)
R   at com.cloudant.client.internal.views.ViewRequestImpl.getResponse(ViewRequestImpl.java:34)
R   at com.profility.database.cloudant.CloudantConnector.getQuestionnaire(CloudantConnector.java:470)
R   at com.profility.database.Database.getQuestionnaire(Database.java:159)
R   at com.profility.questionnaire.QuestionnaireCache.getTheQuestionnaire(QuestionnaireCache.java:21)
R   at com.profility.scheduer.ApplicationStarter.run(ApplicationStarter.java:31)
R   at java.lang.Thread.run(Thread.java:812)

Answer 1

您不需要自定义 SSLSocketFactory 来使用 TLS1.2，您只需配置 JVM 以提供 TLSv1.2。

您可能只需要 support document 中描述的属性com.ibm.jsse2.overrideDefaultTLS=true 以匹配 Oracle 行为并启用 TLS 1.0、1.1。和 1.2(而不是默认的 1.0)。

如果这还不够，您可能需要此 support document 中描述的属性为协议(protocol)启用 TLSv1.2。