使用SSL的Android和Python之间的协议错误

时间：2013-01-02 17:53:58

标签： android python ssl openssl ssl-certificate

这个问题已经多次被问过各种各样的问题。不幸的是，没有一个答案能为我提供解决方案。

我正在尝试使用https协议连接到python Web服务器（要遵循的代码），包括客户端身份验证。当我通过我编写的python客户端连接进行测试时，我没有问题。快进，我现在正尝试从Android设备连接（代码再次关注）并且正在获取

javax.net.ssl.SSLProtocolException

我有一个自签名的CA，它已颁发了两个证书。一个用于客户端，一个用于服务器。

我使用以下命令从服务器私钥中删除了密码：

openssl rsa -in serverKey.pem -out serverKey.pem

并使用linux命令行中的openssl发出请求。

对于我发出请求的客户端，创建了证书，然后使用keytool与BouncyCastle提供程序将CA导入信任存储区，将客户端证书导入密钥存储区（我发现它们的格式相同，只是帮助如果我用不同的名字来称呼它们，我就把它们分开。）

相关服务器代码：

class ReuseHTTPServer(BaseHTTPServer.HTTPServer):
    def __init__(self, address, handler):
        BaseHTTPServer.HTTPServer.__init__(self, address, handler)

        self.address = address

        ssl_socket = ssl.wrap_socket(socket.socket(self.address_family,
                                                   self.socket_type),
                                     keyfile = KEY_PATH,
                                     certfile = CERTIFICATE_PATH,
                                     server_side = True,
                                     cert_reqs = ssl.CERT_REQUIRED,
                                     ssl_version = ssl.PROTOCOL_SSLv23,
                                     ca_certs = CA_PATH)
        s = self.socket.getsockname()

        print "serving:", s[0], "on port:", s[1]

        self.socket = ssl_socket

        self.server_bind()
        self.server_activate()

    def server_bind(self):
        BaseHTTPServer.HTTPServer.server_bind(self)

Android客户端代码：

//add bouncy castle to the list of security providers
Security.insertProviderAt(new BouncyCastleProvider(), 1);

//load the trusted CA
KeyStore trusted = KeyStore.getInstance("BKS");
InputStream in = getResources().openRawResource(R.raw.mobilecastore);
trusted.load(in, "password".toCharArray());
in.close();
TrustManagerFactory trust_factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trust_factory.init(trusted);

//load the client keystore
KeyStore client = KeyStore.getInstance(KeyStore.getDefaultType());
InputStream client_in = getResources().openRawResource(R.raw.client);
client.load(client_in, "password2".toCharArray());
client_in.close();
KeyManagerFactory key_factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());

key_factory.init(client, "password2".toCharArray());

SSLContext ssl_context = SSLContext.getInstance("SSL"); 
ssl_context.init(key_factory.getKeyManagers(), trust_factory.getTrustManagers(), null);

URL url = new URL("https", IP, 60000, "/cgi-bin/www_sel_jf");
connection = (HttpsURLConnection) url.openConnection();
connection.setSSLSocketFactory(ssl_context.getSocketFactory());
connection.setDoInput(true);
connection.setRequestMethod("GET");
connection.connect();

错误：

12-31 07:23:37.917: W/System.err(3666): javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x16bab18: Failure in SSL library, usually a protocol error
12-31 07:23:37.917: W/System.err(3666): error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (external/openssl/ssl/s3_pkt.c:1234 0x16bf980:0x00000003)
12-31 07:23:37.917: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:460)
12-31 07:23:37.917: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:257)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpConnection.setupSecureSocket(HttpConnection.java:210)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.makeSslConnection(HttpsURLConnectionImpl.java:477)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:441)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpEngine.sendSocketRequest(HttpEngine.java:282)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpEngine.sendRequest(HttpEngine.java:232)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:80)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:164)
12-31 07:23:37.917: W/System.err(3666):     at com.dsndata.sds2mobile.status.activities.ServerJobs$RetrieveJobNames.doInBackground(ServerJobs.java:143)
12-31 07:23:37.917: W/System.err(3666):     at com.dsndata.sds2mobile.status.activities.ServerJobs$RetrieveJobNames.doInBackground(ServerJobs.java:1)
12-31 07:23:37.917: W/System.err(3666):     at android.os.AsyncTask$2.call(AsyncTask.java:264)
12-31 07:23:37.925: W/System.err(3666):     at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
12-31 07:23:37.925: W/System.err(3666):     at java.util.concurrent.FutureTask.run(FutureTask.java:137)
12-31 07:23:37.925: W/System.err(3666):     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
12-31 07:23:37.925: W/System.err(3666):     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
12-31 07:23:37.925: W/System.err(3666):     at java.lang.Thread.run(Thread.java:856)
12-31 07:23:37.925: W/System.err(3666): Caused by: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x16bab18: Failure in SSL library, usually a protocol error
12-31 07:23:37.925: W/System.err(3666): error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (external/openssl/ssl/s3_pkt.c:1234 0x16bf980:0x00000003)
12-31 07:23:37.925: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.NativeCrypto.SSL_do_handshake(Native Method)
12-31 07:23:37.925: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:410)
12-31 07:23:37.925: W/System.err(3666):     ... 16 more
12-31 07:23:37.925: W/System.err(3666): javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x16bab18: Failure in SSL library, usually a protocol error
12-31 07:23:37.925: W/System.err(3666): error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (external/openssl/ssl/s3_pkt.c:1234 0x16bf980:0x00000003)
12-31 07:23:37.925: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:460)
12-31 07:23:37.925: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:257)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpConnection.setupSecureSocket(HttpConnection.java:210)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.makeSslConnection(HttpsURLConnectionImpl.java:477)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:441)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpEngine.sendSocketRequest(HttpEngine.java:282)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpEngine.sendRequest(HttpEngine.java:232)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:80)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:164)
12-31 07:23:37.925: W/System.err(3666):     at com.dsndata.sds2mobile.status.activities.ServerJobs$RetrieveJobNames.doInBackground(ServerJobs.java:143)
12-31 07:23:37.932: W/System.err(3666):     at com.dsndata.sds2mobile.status.activities.ServerJobs$RetrieveJobNames.doInBackground(ServerJobs.java:1)
12-31 07:23:37.932: W/System.err(3666):     at android.os.AsyncTask$2.call(AsyncTask.java:264)
12-31 07:23:37.932: W/System.err(3666):     at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
12-31 07:23:37.932: W/System.err(3666):     at java.util.concurrent.FutureTask.run(FutureTask.java:137)
12-31 07:23:37.932: W/System.err(3666):     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
12-31 07:23:37.932: W/System.err(3666):     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
12-31 07:23:37.932: W/System.err(3666):     at java.lang.Thread.run(Thread.java:856)
12-31 07:23:37.932: W/System.err(3666): Caused by: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x16bab18: Failure in SSL library, usually a protocol error
12-31 07:23:37.932: W/System.err(3666): error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (external/openssl/ssl/s3_pkt.c:1234 0x16bf980:0x00000003)
12-31 07:23:37.932: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.NativeCrypto.SSL_do_handshake(Native Method)
12-31 07:23:37.932: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:410)
12-31 07:23:37.932: W/System.err(3666):     ... 16 more

应该注意的是我使用的是javax.net.ssl库而不是apache。

编辑： python服务器托管在Windows机器上。对于Windows端口上的ssl，是否需要考虑额外的配置？

编辑：是的，在Windows端口上需要执行某些操作才能允许SSL。切换到端口443（指定用于SSL流量）并且正在进行（缓慢）进度。

编辑： 我现在能够使用Wireshark跟踪请求（我正在为这个问题学到很多东西！）并且Wireshark告诉我有405错误。 SSL中的哪个意味着无法识别证书格式。 python服务器使用PEM证书（根据python docs允许的唯一格式），导入Android设备上的密钥库的证书是DER（据我所知，BKS接受的唯一格式）。

非常感谢任何帮助。

2 个答案:

答案 0 :(得分：1)

这可能是SSL / TLS版本或算法不匹配错误。您的服务器使用SSL v.2-3，虽然这很旧，但应使用TLS 1.0-1.2。 调试此问题的最佳方法是运行Wireshark，查看发送的客户端和服务器的SSL / TLS握手数据包以及何时断开连接。

答案 1 :(得分：1)

在学习如何读取数据包之后，事实证明问题出在我的证书上。公共名称与URL不匹配。

相关问题
最新问题