java - 使用 OpenJDK 8 时为 "No negotiable cipher suite"，但在使用 Oracle Java 8 时不是

Question

我正在尝试使用带有 sqlline 的 OpenJDK 8 连接到 MariaDB (10.5.6-MariaDB-log) 数据库。连接应使用 ssl。
数据库中的用户是这样创建的:

GRANT ALL PRIVILEGES ON *.* TO `user`@`client` IDENTIFIED BY PASSWORD '*' REQUIRE SSL

Java/操作系统版本:

> java -version
openjdk version "1.8.0_275"
OpenJDK Runtime Environment (build 1.8.0_275-b01)
OpenJDK 64-Bit Server VM (build 25.275-b01, mixed mode)
> cat /etc/system-release
CentOS Linux release 8.3.2011

加密策略设置为无限制: crypto.policy=unlimited这是我正在使用的 sqlline 命令:

java -Djavax.net.debug=all -Djava.ext.dirs=./ sqlline.SqlLine -u 'jdbc:mysql://database:3306/?useSSL=true&trustStore=/etc/ssl/certs/truststore.jks&trustStorePassword=XXXX&enabledSslProtocolSuites=TLSv1,TLSv1.1,TLSv1.2'

运行此命令时，我得到:

javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.191 CET|Logger.java:765|System property jdk.tls.client.cipherSuites is set to 'TLSv1.2'
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.200 CET|Logger.java:765|Transformation RC4 is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.201 CET|Logger.java:765|Transformation DES/CBC/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.201 CET|Logger.java:765|Transformation RC4 is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.202 CET|Logger.java:765|Transformation DES/CBC/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.206 CET|Logger.java:765|Transformation DESede/CBC/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.207 CET|Logger.java:765|Transformation AES/CBC/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.207 CET|Logger.java:765|Transformation AES/CBC/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.208 CET|Logger.java:765|Transformation AES/GCM/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.209 CET|Logger.java:765|Transformation AES/GCM/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.210 CET|Logger.java:765|Transformation AES/GCM/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.210 CET|Logger.java:765|Transformation AES/GCM/NoPadding is not available.
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.210 CET|Logger.java:765|jdk.tls.keyLimits:  entry = AES/GCM/NoPadding KeyUpdate 2^37. AES/GCM/NOPADDING:KEYUPDATE = 137438953472
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.215 CET|Logger.java:765|The current installed providers do not support cipher suite: TLSv1.2
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.215 CET|Logger.java:765|System property jdk.tls.server.cipherSuites is set to 'null'
javax.net.ssl|FINE|01|main|2021-03-24 09:22:09.217 CET|Logger.java:765|Ignore disabled cipher suite: SSL_RSA_WITH_NULL_MD5
javax.net.ssl|ALL|01|main|2021-03-24 09:22:09.218 CET|Logger.java:765|Ignore unsupported cipher suite: SSL_RSA_WITH_NULL_MD5
javax.net.ssl|ALL|01|main|2021-03-24 09:22:09.219 CET|Logger.java:765|trigger seeding of SecureRandom
javax.net.ssl|ALL|01|main|2021-03-24 09:22:09.220 CET|Logger.java:765|done seeding of SecureRandom
javax.net.ssl|SEVERE|01|main|2021-03-24 09:22:09.234 CET|Logger.java:765|Fatal (HANDSHAKE_FAILURE): Couldn't kickstart handshaking (
"throwable" : {
  javax.net.ssl.SSLHandshakeException: No negotiable cipher suite
        at sun.security.ssl.ClientHello$ClientHelloKickstartProducer.produce(ClientHello.java:549)
        at sun.security.ssl.SSLHandshake.kickstart(SSLHandshake.java:500)
        at sun.security.ssl.ClientHandshakeContext.kickstart(ClientHandshakeContext.java:107)
        at sun.security.ssl.TransportContext.kickstart(TransportContext.java:231)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:387)
        at org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.handleConnectionPhases(AbstractConnectProtocol.java:740)
        at org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.connect(AbstractConnectProtocol.java:451)
        at org.mariadb.jdbc.internal.protocol.AbstractConnectProtocol.connectWithoutProxy(AbstractConnectProtocol.java:1103)
        at org.mariadb.jdbc.internal.util.Utils.retrieveProxy(Utils.java:502)
        at org.mariadb.jdbc.MariaDbConnection.newConnection(MariaDbConnection.java:155)
        at org.mariadb.jdbc.Driver.connect(Driver.java:86)
        at sqlline.DatabaseConnection.connect(DatabaseConnection.java:135)
        at sqlline.DatabaseConnection.getConnection(DatabaseConnection.java:192)
        at sqlline.Commands.connect(Commands.java:1364)
        at sqlline.Commands.connect(Commands.java:1244)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.lang.reflect.Method.invoke(Method.java:498)
        at sqlline.ReflectiveCommandHandler.execute(ReflectiveCommandHandler.java:38)
        at sqlline.SqlLine.dispatch(SqlLine.java:730)
        at sqlline.SqlLine.initArgs(SqlLine.java:410)
        at sqlline.SqlLine.begin(SqlLine.java:515)
        at sqlline.SqlLine.start(SqlLine.java:267)
        at sqlline.SqlLine.main(SqlLine.java:206)}

)

使用 Oracle Java 8 时，同样的命令有效:

java -version
java version "1.8.0_121"
Java(TM) SE Runtime Environment (build 1.8.0_121-b13)
Java HotSpot(TM) 64-Bit Server VM (build 25.121-b13, mixed mode)

%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1616509341 bytes = { 110, 230, 172, 110, 8, 97, 81, 50, 49, 52, 8, 49, 117, 225, 175, 97, 163, 91, 97, 1, 194, 134, 50, 185, 109, 189, 164, 80 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_
DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA,
TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA
256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_W
ITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENE
GOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA,
 SHA1withECDSA, SHA1withRSA, SHA1withDSA
***

...

*** ServerHello, TLSv1.2
RandomCookie:  GMT: -1794964180 bytes = { 176, 47, 147, 184, 217, 206, 200, 236, 157, 146, 209, 78, 28, 189, 35, 107, 146, 17, 52, 81, 68, 79, 87, 78, 71, 82, 68, 1 }
Session ID:  {98, 210, 199, 183, 45, 73, 255, 93, 111, 94, 126, 165, 197, 169, 155, 2, 122, 174, 246, 46, 27, 105, 119, 4, 43, 40, 198, 7, 148, 111, 62, 106}
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Compression Method: 0
Extension renegotiation_info, renegotiated_connection: <empty>
Extension ec_point_formats, formats: [uncompressed, ansiX962_compressed_prime, ansiX962_compressed_char2]
***
%% Initialized:  [Session-1, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256]
** TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
[read] MD5 and SHA1 hashes:  len = 89

...

*** CertificateRequest
Cert Types: RSA, ECDSA
Supported Signature Algorithms: SHA256withECDSA, SHA384withECDSA, SHA512withECDSA, Unknown (hash:0x8, signature:0x7), Unknown (hash:0x8, signature:0x8), Unknown (hash:0x8, signature:0x9), Unknown (hash:0x8, sign
ature:0x4), Unknown (hash:0x8, signature:0xa), Unknown (hash:0x8, signature:0x5), Unknown (hash:0x8, signature:0xb), Unknown (hash:0x8, signature:0x6), SHA256withRSA, SHA384withRSA, SHA512withRSA, SHA224withECDS
A, SHA224withRSA, SHA1withECDSA, SHA1withRSA
Cert Authorities:
<Empty>
[read] MD5 and SHA1 hashes:  len = 47
0000: 0D 00 00 2B 02 01 40 00   24 04 03 05 03 06 03 08  ...+..@.$.......
0010: 07 08 08 08 09 08 04 08   0A 08 05 08 0B 08 06 04  ................
0020: 01 05 01 06 01 03 03 03   01 02 03 02 01 00 00     ...............
[Raw read]: length = 5
0000: 16 03 03 00 04                                     .....
[Raw read]: length = 4
0000: 0E 00 00 00                                        ....
main, READ: TLSv1.2 Handshake, length = 4
*** ServerHelloDone
[read] MD5 and SHA1 hashes:  len = 4
0000: 0E 00 00 00                                        ....
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>
***
*** ECDHClientKeyExchange

我错过了什么？为什么它不适用于 OpenJDK？

Answer 1

事实证明，解决方案相当简单。向 java 命令添加另一个扩展目录时，连接有效:

java -Djavax.net.debug=all -Djava.ext.dirs=./:/usr/lib/jvm/java-1.8.0-openjdk-1.8.0.275.b01-1.el8_3.x86_64/jre/lib/ext sqlline.SqlLine -u 'jdbc:mysql://database:3306/?useSSL=true&trustStore=/etc/ssl/certs/truststore.jks&trustStorePassword=XXXX&enabledSslProtocolSuites=TLSv1,TLSv1.1,TLSv1.2'

但是，我不确定为什么会这样。我想附加密码套件所需的库是以下之一:

-rw-r--r--. 1 root root 5174426 24. Mär 11:49 bcprov.jar
-rw-r--r--. 1 root root 4004256  4. Jan 17:36 cldrdata.jar
-rw-r--r--. 1 root root    9441  4. Jan 17:36 dnsns.jar
-rw-r--r--. 1 root root   48729  4. Jan 17:36 jaccess.jar
-rw-r--r--. 1 root root 1208417  4. Jan 17:36 localedata.jar
-rw-r--r--. 1 root root     617  4. Jan 17:36 meta-index
-rw-r--r--. 1 root root 2033825  4. Jan 17:36 nashorn.jar
-rw-r--r--. 1 root root   51889  4. Jan 17:36 sunec.jar
-rw-r--r--. 1 root root  306494  4. Jan 17:36 sunjce_provider.jar
-rw-r--r--. 1 root root  307326  4. Jan 17:36 sunpkcs11.jar
-rw-r--r--. 1 root root   78815  4. Jan 17:36 zipfs.jar