java - 使用 SSL 连接到 Apache FtpServer 时出错

Question

我正在尝试使用 Apache FtpServer 设置一个简单的测试 FTP 服务器，但在配置使用 SSL 时遇到了问题。
关注 Apache FtpServer documentation ，这是我的代码到目前为止的样子:

        FtpServerFactory ftpServerFactory = new FtpServerFactory();
        ListenerFactory listenerFactory = new ListenerFactory();
        listenerFactory.setPort(990);
        listenerFactory.setServerAddress("example.com");

        SslConfigurationFactory sslConfigurationFactory = new SslConfigurationFactory();
        sslConfigurationFactory.setKeystoreFile(JKS);
        sslConfigurationFactory.setKeystorePassword(JKS_PASS);
        listenerFactory.setSslConfiguration(sslConfigurationFactory.createSslConfiguration());
        listenerFactory.setImplicitSsl(true);

        ftpServerFactory.addListener("default", listenerFactory.createListener());

        PropertiesUserManagerFactory userManagerFactory = new PropertiesUserManagerFactory();
        userManagerFactory.setFile(USERS_PATH.toFile());

        BaseUser test = new BaseUser();
        sample1.setName("test");
        sample1.setPassword("test");
        sample1.setHomeDirectory(HOME.getAbsolutePath().toString());
        test.setAuthorities(List.of(new WritePermission());

        UserManager userManager = userManagerFactory.createUserManager();
        try {
            userManager.save(test);
        }
        catch (FtpException e) {
            e.printStackTrace();
        }

        ftpServerFactory.setUserManager(userManager);

        FtpServer server = ftpServerFactory.createServer();
        try {
            server.start();
        }
        catch (FtpException e) {
            e.printStackTrace();
        }

当我尝试连接到 FTPS 服务器时，我从服务器收到此错误:

[main] INFO org.apache.ftpserver.impl.DefaultFtpServer - FTP server started
[NioProcessor-1] WARN org.apache.mina.util.DefaultExceptionMonitor - Unexpected exception.
org.apache.mina.core.filterchain.IoFilterLifeCycleException: onPreAdd(): sslFilter:SslFilter in (0x00000002: nio socket, server, /2.51.214.102:50475 => /142.93.208.41:990)
    at org.apache.mina.core.filterchain.DefaultIoFilterChain.register(DefaultIoFilterChain.java:465)
    at org.apache.mina.core.filterchain.DefaultIoFilterChain.addLast(DefaultIoFilterChain.java:234)
    at org.apache.mina.core.filterchain.DefaultIoFilterChainBuilder.buildFilterChain(DefaultIoFilterChainBuilder.java:553)
    at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.addNow(AbstractPollingIoProcessor.java:832)
    at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.handleNewSessions(AbstractPollingIoProcessor.java:752)
    at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:652)
    at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.IllegalArgumentException: Unsupported protocolTLS
    at java.base/sun.security.ssl.ProtocolVersion.namesOf(ProtocolVersion.java:292)
    at java.base/sun.security.ssl.SSLEngineImpl.setEnabledProtocols(SSLEngineImpl.java:798)
    at org.apache.mina.filter.ssl.SslHandler.init(SslHandler.java:184)
    at org.apache.mina.filter.ssl.SslFilter.onPreAdd(SslFilter.java:458)
    at org.apache.mina.core.filterchain.DefaultIoFilterChain.register(DefaultIoFilterChain.java:463)
    ... 9 more

从我的客户(FileZilla)，我得到这个错误:

Status:         Resolving address of itgsiatest.duss.app
Status:         Connecting to 142.93.208.41:990...
Status:         Connection established, initializing TLS...
Status:         Connection attempt failed with "ECONNRESET - Connection reset by peer".
Error:          Could not connect to server

有什么我错过的吗？

Answer 1

我假设您已经成功设置了 FTP 服务器 without encryption standalone .

我假设你已经成功设置了 FTP 服务器 with encryption standalone .

我假设您已经成功设置了 FTP 服务器 without encryption embedded .

现在您正在尝试合并 加密和嵌入 .正如您正确指出的那样，这也记录在第 3 步中，并且您的代码似乎直接遵循指南。

然而，当客户端连接时发生异常，并且客户端和服务器都尝试初始化 TLS 握手，这在服务器端失败了。所以还是有些不对劲，需要在 TLS 区域内搜索。
您是否检查过您的 keystore 内容？它存在吗？它是否包含正确的证书？它是否包含多个证书？他们的别名是什么？为什么在您的代码中您不必指定应使用哪个证书？
(关于 keystore element 的完整文档提到了一个“ key 别名”，可以使用 this method 进行设置。
要检查的另一件事是为什么在您的日志中应该忽略这么多协议(protocol)。最终还有哪些协议(protocol)需要使用？