Question

我正在java中编写一个接受并响应ajax请求的https服务器。我有这一切都与http连接工作，但https很难设置。如果我使用openssl，我可以点击服务器并获得预期的响应：openssl s_client -connect localhost:5001但是来自浏览器的ajax调用失败。我不知道从哪里开始。

这是调试后的ajax调用后来自服务器的堆栈跟踪：

javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.writeRecord(Unknown Source)
at sun.security.ssl.AppOutputStream.write(Unknown Source)
at sun.nio.cs.StreamEncoder.writeBytes(Unknown Source)
at sun.nio.cs.StreamEncoder.implFlushBuffer(Unknown Source)
at sun.nio.cs.StreamEncoder.implFlush(Unknown Source)
at sun.nio.cs.StreamEncoder.flush(Unknown Source)
at java.io.OutputStreamWriter.flush(Unknown Source)
at java.io.BufferedWriter.flush(Unknown Source)
at com.myDomain.HttpsServer.main(HttpsServer.java:223)
Caused by: java.io.EOFException: SSL peer shut down incorrectly
at sun.security.ssl.InputRecord.read(Unknown Source)
... 11 more

ajax致电：

var command, req;
  command = {
    command: "getStatus",
  };
  command = JSON.stringify(command);
  req = $.ajax("https://localhost:5001", {
    data: command,
    dataType: "jsonp",
    timeout: 1000
  });

Java Server：

private static SSLServerSocket createSSLSocket(){
    SSLServerSocketFactory sslServerSocketFactory =
        (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
    try{
      SSLServerSocket sslSocket =
        (SSLServerSocket) sslServerSocketFactory.createServerSocket(port, 10, InetAddress.getByName("127.0.0.1"));
      return sslSocket;
    } catch (Exception e){
        e.printStackTrace();
    }
    return null;
}

public static void main (String args[]) throws Exception {
    SSLServerSocket sslSocket;
    sslSocket = createSSLSocket();

    while(running) {
        SSLSocket connected = (SSLSocket) sslSocket.accept();
        try{
         BufferedWriter w = new BufferedWriter(
            new outputStreamWriter(connected.getOutputStream()));
             BufferedReader r = new BufferedReader(
                new InputStreamReader(connected.getInputStream()));
             w.write("HTTP/1.0 200 OK");
             w.write("foo");
             w.newLine();
             w.flush();  //THIS IS WHERE THE ACTUAL EXCEPTION IS THROWN (LINE 223)
             w.close();
             r.close();
             connected.close();
        } catch (Exception e){
         e.printStackTrace();
        }
    }
}

这是运行：

java -Djavax.net.ssl.keyStore=mySrvKeystore -Djavax.net.ssl.keyStorePassword=123456 myApp

使用调试选项完成后，看起来mySrvKeystore正常使用。

更新

以下是调试输出的更多信息：

*** ECDH ServerKeyExchange
 Server key: Sun EC public key, 256 bits
   public x coord:      59120686551233854673577061225846672012454441193286172303206804252170042475984
   public y coord: 64356797475544123011351526783519675095229374542555548418334080869325161950574
   parameters: secp256r1 [NIST P-256, X9.62 prime256v1] (1.2.840.10045.3.1.7)
 *** ServerHelloDone
 main, WRITE: TLSv1 Handshake, length = 1317
 main, received EOFException: error
 main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection      during handshake
 %% Invalidated:  [Session-1, TLS_ECDHE_RSA_WITH_RC4_128_SHA]
 main, SEND TLSv1 ALERT:  fatal, description = handshake_failure
 main, WRITE: TLSv1 Alert, length = 2
 main, called closeSocket()

Answer 1

确定这样的握手失败可能很棘手。尝试使用以下命令打开SSL / TLS调试：

-Djavax.net.debug=true

您可能还想在服务器上添加信任库：

-Djavax.net.ssl.trustStore=mySrvKeystore

您使用的浏览器可能不支持密码套件 TLS_ECDHE_RSA_WITH_RC4_128_SHA 。可能是客户端/服务器尝试协商多个并在最后一个上失败。您可以使用以下命令在服务器上打印已启用的密码套件：

String[] cipherSuites = sslSocket.getEnabledCipherSuites();
for (int x = 0; x < cipherSuites.length; x++) {
   System.out.println(cipherSuites[x]);
}

您还可以考虑使用sslSocket.setEnabledCipherSuites()限制服务器提供的密码套件。

有关Sun的一些旧例子，请参阅Using AES in JSSE。

通常，现代浏览器可以与 TLS_RSA_WITH_AES_128_CBC_SHA

等密码套件连接

Java https有握手问题

1 个答案: