使用客户端身份验证的Web服务访问：handshake_failure

时间：2018-10-10 14:37:23

标签： java web-services ssl

我尝试使用pkcs 12格式的证书连接到Web服务，但是我收到此错误javax.net.ssl.SSLHandshakeException：收到致命警报：handshake_failure。我阅读了stackoverflow中存在的每个响应，但我不知道问题出在哪里。

我使用此代码

System.setProperty("javax.net.ssl.keyStoreType", "pkcs12");
System.setProperty("javax.net.ssl.keyStore", "certificato.p12");
System.setProperty("javax.net.ssl.keyStorePassword", "<pw>");

和调试日志：

.....

keyStore is : certificato.p12
keyStore type is : pkcs12
keyStore provider is : 
init keystore
init keymanager of type SunX509

....

trigger seeding of SecureRandom
done seeding SecureRandom
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
main, setSoTimeout(60000) called
main, the previous server name in SNI (type=host_name (0), value=wstest.agenziadoganemonopoli.gov.it) was replaced with (type=host_name (0), value=wstest.agenziadoganemonopoli.gov.it)
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1522402781 bytes = { 230, 149, 170, 160, 96, 3, 20, 194, 35, 95, 51, 144, 240, 242, 1, 185, 116, 210, 225, 214, 208, 170, 253, 30, 253, 205, 77, 198 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV, TLS_KRB5_WITH_3DES_EDE_CBC_SHA]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Extension extended_master_secret
Extension server_name, server_name: [type=host_name (0), value=wstest.agenziadoganemonopoli.gov.it]
***
main, WRITE: TLSv1.2 Handshake, length = 217
main, READ: TLSv1.2 Handshake, length = 89
*** ServerHello, TLSv1.2
RandomCookie:  GMT: 843419311 bytes = { 2, 154, 215, 104, 32, 197, 59, 136, 48, 242, 21, 86, 144, 250, 121, 115, 130, 97, 90, 238, 44, 73, 133, 103, 122, 36, 210, 246 }
Session ID:  {3, 111, 126, 100, 51, 57, 110, 201, 135, 102, 65, 156, 56, 132, 148, 198, 229, 47, 220, 146, 214, 66, 71, 233, 251, 146, 231, 74, 20, 55, 43, 145}
Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Compression Method: 0
Extension renegotiation_info, renegotiated_connection: <empty>
Extension ec_point_formats, formats: [uncompressed, ansiX962_compressed_prime, ansiX962_compressed_char2]
***
%% Initialized:  [Session-1, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384]
** TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
main, READ: TLSv1.2 Handshake, length = 3881
*** Certificate chain
chain [0] = [
[
  Version: V3
  Subject: CN=wstest.adm.gov.it, O=Sogei - Societa' Generale d'Informatica S.p.A., L=Rome, C=IT
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  modulus: 25419731442206390593645385783404702655267624607655886886586579033277263788093373992316533519614413768987220348067912658765779900645263321853746972064637161938435805567613643957429752362355933531417681870133823645315121191427143131377937830838050657155922764655579621555942502387731877471464619602709418992558060826542318275546503785686897936728729751825524180287855913433073881874132502422571860488498582431532471712013797553571057054314243072094292449266868965533309794853529204639866789866609617498173211239260574372830187459660967406616094045636157545783011722924489392938382648416564815561090724635178650796195467
  public exponent: 65537
  Validity: [From: Mon May 21 02:00:00 CEST 2018,
               To: Thu May 28 14:00:00 CEST 2020]
  Issuer: CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US
  SerialNumber: [    08e09466 2094b01d 65a1b95f 3eb92c66]

Certificate Extensions: 10
[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 82 01 6F 04 82 01 6B   01 69 00 76 00 A4 B9 09  ...o...k.i.v....
0010: 90 B4 18 58 14 87 BB 13   A2 CC 67 70 0A 3C 35 98  ...X......gp.<5.
0020: 04 F9 1B DF B8 E3 77 CD   0E C8 0D DC 10 00 00 01  ......w.........
0030: 63 82 03 F4 00 00 00 04   03 00 47 30 45 02 21 00  c.........G0E.!.
0040: 9A A2 E4 E3 3B 1A F2 02   63 E6 9D A6 62 E7 C0 DC  ....;...c...b...
0050: 8D 95 70 54 01 D5 07 1B   40 B9 11 FD 4A 2D 1C C4  ..pT....@...J-..
0060: 02 20 2C BC 8B 1A 55 0E   25 8C FC B8 29 55 F5 EE  . ,...U.%...)U..
0070: 9C 2A B7 97 34 5C 95 FC   A4 F5 9E 6C 38 90 F0 B7  .*..4\.....l8...
0080: DD F4 00 77 00 6F 53 76   AC 31 F0 31 19 D8 99 00  ...w.oSv.1.1....
0090: A4 51 15 FF 77 15 1C 11   D9 02 C1 00 29 06 8D B2  .Q..w.......)...
00A0: 08 9A 37 D9 13 00 00 01   63 82 03 F4 69 00 00 04  ..7.....c...i...
00B0: 03 00 48 30 46 02 21 00   B6 41 FD F7 CE 31 4D 75  ..H0F.!..A...1Mu
00C0: A4 BB D6 2E E7 66 0D 03   2B 6C 97 35 ED 86 DC 25  .....f..+l.5...%
00D0: EF 6C 00 B4 BC 1C B3 FE   02 21 00 D2 C5 BA 46 42  .l.......!....FB
00E0: 38 F2 68 8F 68 A8 14 1F   A3 0C 52 CB 0A BE DD E0  8.h.h.....R.....
00F0: E9 F2 FA E7 E2 9F 22 8E   3B 2B 06 00 76 00 BB D9  ......".;+..v...
0100: DF BC 1F 8A 71 B5 93 94   23 97 AA 92 7B 47 38 57  ....q...#....G8W
0110: 95 0A AB 52 E8 1A 90 96   64 36 8E 1E D1 85 00 00  ...R....d6......
0120: 01 63 82 03 F3 5E 00 00   04 03 00 47 30 45 02 21  .c...^.....G0E.!
0130: 00 9A 67 22 9D CC B4 B6   F0 34 B8 FE 57 6D FA 2C  ..g".....4..Wm.,
0140: 47 37 F0 93 D6 18 63 68   C6 C2 F0 99 83 F6 EE D1  G7....ch........
0150: CC 02 20 68 47 59 19 AE   02 D3 E6 30 27 EF 48 76  .. hGY.....0'.Hv
0160: 27 9A F8 5B 60 CD B4 4A   03 08 38 DC 72 AB ED 65  '..[`..J..8.r..e
0170: 94 A7 5E                                           ..^


[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://ocsp.digicert.com
, 
   accessMethod: caIssuers
   accessLocation: URIName: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt
]
]

[3]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 0F 80 61 1C 82 31 61 D5   2F 28 E7 8D 46 38 B4 2C  ..a..1a./(..F8.,
0010: E1 C6 D9 E2                                        ....
]
]

[4]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

[5]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl3.digicert.com/ssca-sha2-g6.crl]
, DistributionPoint:
     [URIName: http://crl4.digicert.com/ssca-sha2-g6.crl]
]]

[6]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.16.840.1.114412.1.1]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 1C 68 74 74 70 73 3A   2F 2F 77 77 77 2E 64 69  ..https://www.di
0010: 67 69 63 65 72 74 2E 63   6F 6D 2F 43 50 53        gicert.com/CPS

]]  ]
  [CertificatePolicyId: [2.23.140.1.2.2]
[]  ]
]

[7]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

[8]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

[9]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: wstest.adm.gov.it
  DNSName: wstest.agenziadoganemonopoli.gov.it
]

[10]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 13 86 1A C9 BF 3A 50 51   77 C2 23 D7 A0 B9 9F 93  .....:PQw.#.....
0010: 15 A5 2E 98                                        ....
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
.... deleted ....

]
chain [1] = [
[
  Version: V3
  Subject: CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  modulus: 27858400285679723188777933283712642951289579686400775596360785472462618845441045591174031407467141927949303967273640603370583027943461489694611514307846044788608302737755893035638149922272068624160730850926560034092625156444445564936562297688651849223419070532331233030323585681010618165796464257277453762819678070632408347042070801988771058882131228632546107451893714991242153395658429259537934263208634002792828772169217510656239241005311075681025394047894661420520700962300445533960645787118986590875906485125942483622981513806162241672544997253865343228332025582679476240480384023017494305830194847248717881628827
  public exponent: 65537
  Validity: [From: Fri Mar 08 13:00:00 CET 2013,
               To: Wed Mar 08 13:00:00 CET 2023]
  Issuer: CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US
  SerialNumber: [    01fda3eb 6eca75c8 88438b72 4bcfbc91]

Certificate Extensions: 7
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://ocsp.digicert.com
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 03 DE 50 35 56 D1 4C BB   66 F0 A3 E2 1B 1B C3 97  ..P5V.L.f.......
0010: B2 3D D1 55                                        .=.U
]
]

[3]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:0
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl3.digicert.com/DigiCertGlobalRootCA.crl]
, DistributionPoint:
     [URIName: http://crl4.digicert.com/DigiCertGlobalRootCA.crl]
]]

[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.5.29.32.0]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 1C 68 74 74 70 73 3A   2F 2F 77 77 77 2E 64 69  ..https://www.di
0010: 67 69 63 65 72 74 2E 63   6F 6D 2F 43 50 53        gicert.com/CPS

]]  ]
]

[6]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_CertSign
  Crl_Sign
]

[7]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 0F 80 61 1C 82 31 61 D5   2F 28 E7 8D 46 38 B4 2C  ..a..1a./(..F8.,
0010: E1 C6 D9 E2                                        ....
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 23 3E DF 4B D2 31 42 A5   B6 7E 42 5C 1A 44 CC 69  #>.K.1B...B\.D.i
0010: D1 68 B4 5D 4B E0 04 21   6C 4B E2 6D CC B1 E0 97  .h.]K..!lK.m....
0020: 8F A6 53 09 CD AA 2A 65   E5 39 4F 1E 83 A5 6E 5C  ..S...*e.9O...n\
0030: 98 A2 24 26 E6 FB A1 ED   93 C7 2E 02 C6 4D 4A BF  ..$&.........MJ.
0040: B0 42 DF 78 DA B3 A8 F9   6D FF 21 85 53 36 60 4C  .B.x....m.!.S6`L
0050: 76 CE EC 38 DC D6 51 80   F0 C5 D6 E5 D4 4D 27 64  v..8..Q......M'd
0060: AB 9B C7 3E 71 FB 48 97   B8 33 6D C9 13 07 EE 96  ...>q.H..3m.....
0070: A2 1B 18 15 F6 5C 4C 40   ED B3 C2 EC FF 71 C1 E3  .....\L@.....q..
0080: 47 FF D4 B9 00 B4 37 42   DA 20 C9 EA 6E 8A EE 14  G.....7B. ..n...
0090: 06 AE 7D A2 59 98 88 A8   1B 6F 2D F4 F2 C9 14 5F  ....Y....o-...._
00A0: 26 CF 2C 8D 7E ED 37 C0   A9 D5 39 B9 82 BF 19 0C  &.,...7...9.....
00B0: EA 34 AF 00 21 68 F8 AD   73 E2 C9 32 DA 38 25 0B  .4..!h..s..2.8%.
00C0: 55 D3 9A 1D F0 68 86 ED   2E 41 34 EF 7C A5 50 1D  U....h...A4...P.
00D0: BF 3A F9 D3 C1 08 0C E6   ED 1E 8A 58 25 E4 B8 77  .:.........X%..w
00E0: AD 2D 6E F5 52 DD B4 74   8F AB 49 2E 9D 3B 93 34  .-n.R..t..I..;.4
00F0: 28 1F 78 CE 94 EA C7 BD   D3 C9 6D 1C DE 5C 32 F3  (.x.......m..\2.

]
chain [2] = [
[
  Version: V3
  Subject: CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US
  Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5

  Key:  Sun RSA public key, 2048 bits
  modulus: 28559384442792876273280274398620578979733786817784174960112400169719065906301471912340204391164075730987771255281479191858503912379974443363319206013285922932969143082114108995903507302607372164107846395526169928849546930352778612946811335349917424469188917500996253619438384218721744278787164274625243781917237444202229339672234113350935948264576180342492691117960376023738627349150441152487120197333042448834154779966801277094070528166918968412433078879939664053044797116916260095055641583506170045241549105022323819314163625798834513544420165235412105694681616578431019525684868803389424296613694298865514217451303
  public exponent: 65537
  Validity: [From: Fri Nov 10 01:00:00 CET 2006,
               To: Mon Nov 10 01:00:00 CET 2031]
  Issuer: CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US
  SerialNumber: [    083be056 904246b1 a1756ac9 5991c74a]

Certificate Extensions: 4
[1]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 03 DE 50 35 56 D1 4C BB   66 F0 A3 E2 1B 1B C3 97  ..P5V.L.f.......
0010: B2 3D D1 55                                        .=.U
]
]

[2]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

[3]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_CertSign
  Crl_Sign
]

[4]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 03 DE 50 35 56 D1 4C BB   66 F0 A3 E2 1B 1B C3 97  ..P5V.L.f.......
0010: B2 3D D1 55                                        .=.U
]
]

]
  Algorithm: [SHA1withRSA]
  Signature:
0000: CB 9C 37 AA 48 13 12 0A   FA DD 44 9C 4F 52 B0 F4  ..7.H.....D.OR..
0010: DF AE 04 F5 79 79 08 A3   24 18 FC 4B 2B 84 C0 2D  ....yy..$..K+..-
0020: B9 D5 C7 FE F4 C1 1F 58   CB B8 6D 9C 7A 74 E7 98  .......X..m.zt..
0030: 29 AB 11 B5 E3 70 A0 A1   CD 4C 88 99 93 8C 91 70  )....p...L.....p
0040: E2 AB 0F 1C BE 93 A9 FF   63 D5 E4 07 60 D3 A3 BF  ........c...`...
0050: 9D 5B 09 F1 D5 8E E3 53   F4 8E 63 FA 3F A7 DB B4  .[.....S..c.?...
0060: 66 DF 62 66 D6 D1 6E 41   8D F2 2D B5 EA 77 4A 9F  f.bf..nA..-..wJ.
0070: 9D 58 E2 2B 59 C0 40 23   ED 2D 28 82 45 3E 79 54  .X.+Y.@#.-(.E>yT
0080: 92 26 98 E0 80 48 A8 37   EF F0 D6 79 60 16 DE AC  .&...H.7...y`...
0090: E8 0E CD 6E AC 44 17 38   2F 49 DA E1 45 3E 2A B9  ...n.D.8/I..E>*.
00A0: 36 53 CF 3A 50 06 F7 2E   E8 C4 57 49 6C 61 21 18  6S.:P.....WIla!.
00B0: D5 04 AD 78 3C 2C 3A 80   6B A7 EB AF 15 14 E9 D8  ...x<,:.k.......
00C0: 89 C1 B9 38 6C E2 91 6C   8A FF 64 B9 77 25 57 30  ...8l..l..d.w%W0
00D0: C0 1B 24 A3 E1 DC E9 DF   47 7C B5 B4 24 08 05 30  ..$.....G...$..0
00E0: EC 2D BD 0B BF 45 BF 50   B9 A9 F3 EB 98 01 12 AD  .-...E.P........
00F0: C8 88 C6 98 34 5F 8D 0A   3C C6 E9 D5 95 95 6D DE  ....4_..<.....m.

]
***
Found trusted certificate:
[
[
  Version: V3
  Subject: CN=wstest.adm.gov.it, O=Sogei - Societa' Generale d'Informatica S.p.A., L=Rome, C=IT
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  modulus: 25419731442206390593645385783404702655267624607655886886586579033277263788093373992316533519614413768987220348067912658765779900645263321853746972064637161938435805567613643957429752362355933531417681870133823645315121191427143131377937830838050657155922764655579621555942502387731877471464619602709418992558060826542318275546503785686897936728729751825524180287855913433073881874132502422571860488498582431532471712013797553571057054314243072094292449266868965533309794853529204639866789866609617498173211239260574372830187459660967406616094045636157545783011722924489392938382648416564815561090724635178650796195467
  public exponent: 65537
  Validity: [From: Mon May 21 02:00:00 CEST 2018,
               To: Thu May 28 14:00:00 CEST 2020]
  Issuer: CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US
  SerialNumber: [    08e09466 2094b01d 65a1b95f 3eb92c66]

Certificate Extensions: 10
[1]: ObjectId: 1.3.6.1.4.1.11129.2.4.2 Criticality=false
Extension unknown: DER encoded OCTET string =
0000: 04 82 01 6F 04 82 01 6B   01 69 00 76 00 A4 B9 09  ...o...k.i.v....
0010: 90 B4 18 58 14 87 BB 13   A2 CC 67 70 0A 3C 35 98  ...X......gp.<5.
0020: 04 F9 1B DF B8 E3 77 CD   0E C8 0D DC 10 00 00 01  ......w.........
0030: 63 82 03 F4 00 00 00 04   03 00 47 30 45 02 21 00  c.........G0E.!.
0040: 9A A2 E4 E3 3B 1A F2 02   63 E6 9D A6 62 E7 C0 DC  ....;...c...b...
0050: 8D 95 70 54 01 D5 07 1B   40 B9 11 FD 4A 2D 1C C4  ..pT....@...J-..
0060: 02 20 2C BC 8B 1A 55 0E   25 8C FC B8 29 55 F5 EE  . ,...U.%...)U..
0070: 9C 2A B7 97 34 5C 95 FC   A4 F5 9E 6C 38 90 F0 B7  .*..4\.....l8...
0080: DD F4 00 77 00 6F 53 76   AC 31 F0 31 19 D8 99 00  ...w.oSv.1.1....
0090: A4 51 15 FF 77 15 1C 11   D9 02 C1 00 29 06 8D B2  .Q..w.......)...
00A0: 08 9A 37 D9 13 00 00 01   63 82 03 F4 69 00 00 04  ..7.....c...i...
00B0: 03 00 48 30 46 02 21 00   B6 41 FD F7 CE 31 4D 75  ..H0F.!..A...1Mu
00C0: A4 BB D6 2E E7 66 0D 03   2B 6C 97 35 ED 86 DC 25  .....f..+l.5...%
00D0: EF 6C 00 B4 BC 1C B3 FE   02 21 00 D2 C5 BA 46 42  .l.......!....FB
00E0: 38 F2 68 8F 68 A8 14 1F   A3 0C 52 CB 0A BE DD E0  8.h.h.....R.....
00F0: E9 F2 FA E7 E2 9F 22 8E   3B 2B 06 00 76 00 BB D9  ......".;+..v...
0100: DF BC 1F 8A 71 B5 93 94   23 97 AA 92 7B 47 38 57  ....q...#....G8W
0110: 95 0A AB 52 E8 1A 90 96   64 36 8E 1E D1 85 00 00  ...R....d6......
0120: 01 63 82 03 F3 5E 00 00   04 03 00 47 30 45 02 21  .c...^.....G0E.!
0130: 00 9A 67 22 9D CC B4 B6   F0 34 B8 FE 57 6D FA 2C  ..g".....4..Wm.,
0140: 47 37 F0 93 D6 18 63 68   C6 C2 F0 99 83 F6 EE D1  G7....ch........
0150: CC 02 20 68 47 59 19 AE   02 D3 E6 30 27 EF 48 76  .. hGY.....0'.Hv
0160: 27 9A F8 5B 60 CD B4 4A   03 08 38 DC 72 AB ED 65  '..[`..J..8.r..e
0170: 94 A7 5E                                           ..^


[2]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://ocsp.digicert.com
, 
   accessMethod: caIssuers
   accessLocation: URIName: http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt
]
]

[3]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 0F 80 61 1C 82 31 61 D5   2F 28 E7 8D 46 38 B4 2C  ..a..1a./(..F8.,
0010: E1 C6 D9 E2                                        ....
]
]

[4]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

[5]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl3.digicert.com/ssca-sha2-g6.crl]
, DistributionPoint:
     [URIName: http://crl4.digicert.com/ssca-sha2-g6.crl]
]]

[6]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.16.840.1.114412.1.1]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 1C 68 74 74 70 73 3A   2F 2F 77 77 77 2E 64 69  ..https://www.di
0010: 67 69 63 65 72 74 2E 63   6F 6D 2F 43 50 53        gicert.com/CPS

]]  ]
  [CertificatePolicyId: [2.23.140.1.2.2]
[]  ]
]

[7]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

[8]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

[9]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: wstest.adm.gov.it
  DNSName: wstest.agenziadoganemonopoli.gov.it
]

[10]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 13 86 1A C9 BF 3A 50 51   77 C2 23 D7 A0 B9 9F 93  .....:PQw.#.....
0010: 15 A5 2E 98                                        ....
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: AE 8B FD 52 1E 1C 80 F8   84 5C 81 D9 FE D2 CB 7E  ...R.....\......
0010: F4 7F 53 56 AD 0E D8 DF   DC A0 3F 64 BE 66 DF C1  ..SV......?d.f..
0020: 4C 7D 03 A1 E3 A6 D5 E7   2C 5C 69 02 83 6E D6 4F  L.......,\i..n.O
0030: 81 6B 05 6F 98 04 20 94   B1 A3 EF 5A BB 2D A9 78  .k.o.. ....Z.-.x
0040: 8F 8F E0 78 AD 22 B8 5F   F4 30 4B BD 63 94 E3 FA  ...x."._.0K.c...
0050: C0 3A 7C 76 B7 8D 11 FC   7E 55 F4 A9 CF 7A DA 67  .:.v.....U...z.g
0060: 2B B7 2D A9 F0 93 57 B8   DD E2 91 03 9D 90 03 B6  +.-...W.........
0070: 75 94 3F DA 75 16 3D 2A   54 92 02 1D 10 7F C6 A9  u.?.u.=*T.......
0080: EB C8 67 B4 E9 05 84 1F   FF B8 C6 AB 8B A8 F2 E4  ..g.............
0090: EA F2 D2 E8 03 80 FF 1D   4E 2A EA 10 54 34 38 C4  ........N*..T48.
00A0: 79 89 06 10 73 04 6C CF   1B 8A DF E8 BE BF 67 96  y...s.l.......g.
00B0: B6 92 77 A9 AD 73 2B D8   A8 FC BD 50 39 83 4D 75  ..w..s+....P9.Mu
00C0: 59 78 00 48 AC EF AA 1C   92 A6 34 34 C5 9E 5D 1C  Yx.H......44..].
00D0: B1 25 A5 0E BF 90 D0 8F   87 7F 10 5D C0 F4 5D 03  .%.........]..].
00E0: 18 42 C8 62 32 94 D0 2F   34 43 93 28 F3 60 91 CF  .B.b2../4C.(.`..
00F0: 5D 27 D1 E5 00 3B 09 B4   EB 9F 63 AE E2 AA 9B F0  ]'...;....c.....

]
main, READ: TLSv1.2 Handshake, length = 401
*** ECDH ServerKeyExchange
Signature Algorithm SHA512withRSA
Server key: Sun EC public key, 521 bits
  public x coord: 6045100197973385201207771559448860684258102659082760208907503122802851644235164834387633913906709736246059687127225117512119492050557728511283217428042196683
  public y coord: 2360883751657537086387545659332980524396108773124766916635460732420511834927919909730280023858128820419409002491789355667533178954193764726472471819590561957
  parameters: secp521r1 [NIST P-521] (1.3.132.0.35)
main, READ: TLSv1.2 Handshake, length = 392
*** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Supported Signature Algorithms: SHA512withRSA, Unknown (hash:0x6, signature:0x2), SHA512withECDSA, SHA384withRSA, Unknown (hash:0x5, signature:0x2), SHA384withECDSA, SHA256withRSA, SHA256withDSA, SHA256withECDSA, SHA224withRSA, SHA224withDSA, SHA224withECDSA, SHA1withRSA, SHA1withDSA, SHA1withECDSA
Cert Authorities:
<CN=CA Agenzia delle Dogane Test, OU=Servizio Telematico, O=Agenzia delle Dogane, C=it>
<CN=CA Agenzia delle Dogane, OU=Servizio Telematico, O=Agenzia delle Dogane, C=IT>
<CN=CA Agenzia delle Dogane e dei Monopoli Test, O=Agenzia delle Dogane e dei Monopoli, C=IT>
*** ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>
***
*** ECDHClientKeyExchange
ECDH Public value:  { 4, 1, 127, 118, 238, 87, 20, 170, 152, 173, 222, 199, 191, 190, 60, 225, 192, 50, 182, 3, 172, 253, 250, 146, 185, 9, 185, 210, 101, 70, 124, 133, 100, 77, 38, 192, 17, 178, 136, 108, 118, 233, 121, 52, 237, 63, 87, 98, 224, 194, 163, 186, 33, 98, 72, 227, 168, 9, 124, 44, 179, 136, 216, 32, 182, 21, 230, 1, 206, 141, 86, 19, 84, 36, 3, 141, 180, 185, 45, 5, 110, 24, 249, 220, 164, 87, 222, 48, 115, 134, 145, 66, 151, 62, 93, 18, 97, 109, 20, 239, 168, 45, 208, 19, 253, 122, 6, 128, 58, 49, 80, 16, 205, 203, 68, 200, 221, 203, 91, 73, 99, 76, 195, 83, 157, 197, 209, 91, 98, 173, 80, 123, 120 }
main, WRITE: TLSv1.2 Handshake, length = 145
SESSION KEYGEN:
PreMaster Secret:
0000: 00 76 B0 FC E9 4A 80 89   B2 88 A4 21 CE A3 FF 3C  .v...J.....!...<
0010: D0 1F 48 3B B2 D8 84 24   14 EB 77 9E 3C 20 64 CE  ..H;...$..w.< d.
0020: EF 2F 7A 90 50 6F 2D 75   4C 9B 9F 48 0B 04 01 A6  ./z.Po-uL..H....
0030: 2D C3 8B 2D 10 B6 FD AC   AE 66 85 F8 1E 5E 8A 62  -..-.....f...^.b
0040: 46 CE                                              F.
CONNECTION KEYGEN:
Client Nonce:
0000: 5B BE 06 DD E6 95 AA A0   60 03 14 C2 23 5F 33 90  [.......`...#_3.
0010: F0 F2 01 B9 74 D2 E1 D6   D0 AA FD 1E FD CD 4D C6  ....t.........M.
Server Nonce:
0000: 32 46 8F AF 02 9A D7 68   20 C5 3B 88 30 F2 15 56  2F.....h .;.0..V
0010: 90 FA 79 73 82 61 5A EE   2C 49 85 67 7A 24 D2 F6  ..ys.aZ.,I.gz$..
Master Secret:
0000: 4D 96 F1 24 13 EA 84 96   D3 D6 6D DD 64 92 05 F9  M..$......m.d...
0010: D2 BA BF 04 80 79 71 66   9C A6 EA 9B AC 3A 4D 37  .....yqf.....:M7
0020: 90 BE A6 C4 37 B8 70 63   1D B2 74 5A DA 8C 98 34  ....7.pc..tZ...4
... no MAC keys used for this cipher
Client write key:
0000: C3 1C 66 54 84 5A F7 B6   D9 9B 04 80 11 E4 9F E4  ..fT.Z..........
0010: 83 67 52 95 B5 E9 36 CE   0C A2 BF AA AE A2 E1 7C  .gR...6.........
Server write key:
0000: B9 44 4A 92 B6 95 DE CA   89 D0 8E A0 88 50 11 6B  .DJ..........P.k
0010: EC 34 65 52 FD BB 45 C3   57 26 BF A0 A4 B2 90 2F  .4eR..E.W&...../
Client write IV:
0000: F8 A3 11 9A                                        ....
Server write IV:
0000: 47 B6 75 08                                        G.u.
main, WRITE: TLSv1.2 Change Cipher Spec, length = 1
*** Finished
verify_data:  { 21, 80, 48, 53, 249, 154, 28, 96, 252, 49, 18, 72 }
***
main, WRITE: TLSv1.2 Handshake, length = 40
main, READ: TLSv1.2 Alert, length = 2
main, RECV TLSv1.2 ALERT:  fatal, handshake_failure
%% Invalidated:  [Session-1, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384]
main, called closeSocket()
main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
main, called close()
main, called closeInternal(true)

似乎证书已正确加载，因此我无法确定问题出在哪里。任何人都可以帮助您理解吗？

如果我将证书与chrome或Firefox结合使用，则可以访问网络服务，因此证书正确无误。

2 个答案:

答案 0 :(得分：0)

该错误似乎与客户端和服务器之间的信任有关：

Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>

如果未找到合适的证书，并且证书链为空，则程序不信任您正在连接的对等方的根CA证书。

检查信任存储，以查看是否至少导入了对等方的根CA证书。

答案 1 :(得分：0)

这是您日志的重要部分：

*** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Supported Signature Algorithms: SHA512withRSA, Unknown (hash:0x6, signature:0x2), SHA512withECDSA, SHA384withRSA, Unknown (hash:0x5, signature:0x2), SHA384withECDSA, SHA256withRSA, SHA256withDSA, SHA256withECDSA, SHA224withRSA, SHA224withDSA, SHA224withECDSA, SHA1withRSA, SHA1withDSA, SHA1withECDSA
Cert Authorities:
<CN=CA Agenzia delle Dogane Test, OU=Servizio Telematico, O=Agenzia delle Dogane, C=it>
<CN=CA Agenzia delle Dogane, OU=Servizio Telematico, O=Agenzia delle Dogane, C=IT>
<CN=CA Agenzia delle Dogane e dei Monopoli Test, O=Agenzia delle Dogane e dei Monopoli, C=IT>
*** ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>

这意味着密钥管理器在您的密钥库中找不到由服务器指定的任何证书颁发机构（CA）颁发的证书和密钥条目。您删除了（带点）日志中密钥管理器初始化应该已经记录了在密钥库中找到的证书链的部分-这样做了吗？ 如果没有，请使用keytool -list -v -keystore certifcado.p12 -storetype pkcs12 [-alias your_alias_name]。实际上，该链中的证书之一是由服务器指定的CA之一颁发的吗？ （请注意，名称必须完全匹配 ：每个RDN的类型和值均应相同。按顺序。即使在当今，这种情况下，证书中的颁发者名称和CA要求的名称也可能会相同。外观相同，但实际上由于ASN.1编码不同而有所不同。如果它们看起来相同，我将在更神秘的地方进行详细介绍。）

编辑：好的，that full log确认密钥管理器正在使用Issuer: CN=CA Agenzia delle Dogane e dei Monopoli Test, O=Agenzia delle Dogane e dei Monopoli, C=IT加载密钥和证书，该密钥和证书肯定与服务器请求的第三个CA匹配。 Chrome和Firefox可以正常工作（很抱歉，我之前错过了），这很好地证实了它的确匹配。那么，Java（JSSE + keymanager）为什么不匹配它呢？我不知道，这可能不容易调试。我不认为在maven下运行或使用cxf应该有任何效果，但是它们可能会起作用。我建议从最简单的情况开始：编译并运行这样的程序（使用javax.net.ssl.keyStore *和javax.net.debug sysprops），并查看此连接会得到什么结果：

 public class sometest {
     public static void main (String[] args) throws Exception {
          Socket s = SSLSocketFactory.getDefault().createSocket("wstest.agenziadoganemonopoli.gov.it",443);
          // per comment, type fixed (for anyone else who might have a similar issue)
          ((SSLSocket)s).startHandshake(); // actually completes not just starts
     }
 }

如果这表明失败了，我们要调查一个简单得多的案例。如果可行，请尝试：

 public class sometest {
     public static void main (String[] args) throws Exception {
         URLConnection c = new URL("https://wstest.agenziadoganemonopoli.gov.it/").openConnection();
         ((HttpsURLConnection)c).connect();
     }
 }
 // for TLS-level test it doesn't matter what 'resource' (path and/or query) we request
相关问题
最新问题