Question

我正在尝试使用jdk版本1.6.0_29编写Java https客户端（使用HttpsURLConnection）。然后我将证书/wlserver_10.3/server/lib/CertGenCA.der导入到客户端的密钥库中。通过以下命令：

keytool -import -alias test -keystore“D：\ Program Files \ Java \ jdk1.6.0_29 \ jre \ lib \ security \ cacerts”-file CertGenCA.der

问题是我一直得到“线程中的异常”主“javax.net.ssl.SSLHandshakeException：握手期间远程主机关闭连接”SSL调试输出如下：

           keyStore is : 
           keyStore type is : 
           jks keyStore provider is : 
           init keystore

           init keymanager of type SunX509
           trustStore is: D:\Program Files\Java\jdk1.6.0_29\jre\lib\security\cacerts
           trustStore type is : jks
           trustStore provider is : 
           init truststore
enter code here
adding as trusted cert:
Subject: CN=SwissSign Platinum CA - G2, O=SwissSign AG, C=CH
Issuer:  CN=SwissSign Platinum CA - G2, O=SwissSign AG, C=CH 
Algorithm: RSA; Serial number: 0x4eb200670c035d4f 
Valid from Wed Oct 25 04:36:00 VET 2006 until Sat Oct 25 04:06:00 VET 2036



adding as trusted cert:
Subject: EMAILADDRESS=info@valicert.com, CN=http://www.valicert.com/, OU=ValiCert Class    1 Policy Validation Authority, O="ValiCert, Inc.", L=ValiCert Validation Network

发行人：EMAILADDRESS = info @ valicert.com，CN = http://www.valicert.com/，OU = ValiCert Class 1 Policy Validation Authority，O =“ValiCert，Inc。”，L = ValiCert Validation Network 算法：RSA;序列号：0x1 有效期自6月25日星期五18:23:48 VET 1999至Tue Jun 25 17:53:48 VET 2019

.. .. ..

            trigger seeding of SecureRandom
            done seeding SecureRandom

            Allow unsafe renegotiation: false 
            Allow legacy hello messages: true 
            Is initial handshake: true 
            Is secure renegotiation: false 

            %% No cached client session 
            *** ClientHello, SSLv3 
            RandomCookie:  GMT: 1362670800 bytes = { 77, 1, 89, 245, 75, 245, 125, 199, 168, 78, 33, 255, 83, 57, 65, 228, 118, 11, 240, 48, 210, 7, 245, 45, 70, 153, 149, 149 }


            Session ID:  {} 
            Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]

              Compression Methods:  { 0 } 
              *** 
              main, WRITE: SSLv3 Handshake, length = 75 
              main, received EOFException: error 
              Exception in thread "main" javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake

main，处理异常：javax.net.ssl.SSLHandshakeException：握手期间远程主机关闭连接

              main, SEND TLSv1 ALERT:  fatal, description = handshake_failure
              main, WRITE: TLSv1 Alert, length = 2 
              main, called closeSocket()

main，叫做close（） main，叫做closeInternal（true）在com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord（SSLSocketImpl.java:849）

.. ..

               Caused by: java.io.EOFException: SSL peer shut down incorrectly
               at com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java:333)
               at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:830)
... 7 more

不确定如何解释所有这些信息

我的代码是从Eclipse和URL（JAX-WS）运行的，它正在LAB和solaris框中

我的测试客户端代码如下：


URL wsdlLocation = new URL("https://server.lab.ciso.com:8833/Impl/Service?wsdl");

    System.setProperty("weblogic.security.SSL.ignoreHostnameVerification", "true");
    System.setProperty("javax.net.ssl.trustStore", "D:\\Program Files\\Java\\jdk1.6.0_29\\jre\\lib\\security\\cacerts");
    System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
    System.setProperty("https.protocols", "SSLv3");

    SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();

    HttpsURLConnection conn = null;
    try {
        conn = (HttpsURLConnection) wsdlLocation.openConnection();
        conn.setSSLSocketFactory(sslsocketfactory);
        conn.setDoOutput(true);
        conn.setUseCaches(false);
        conn.setRequestMethod("GET");
        conn.setRequestProperty("Content-Type","application/Json");
        conn.setDoInput(true);
        conn.connect();
        BufferedReader br = new BufferedReader(new InputStreamReader(conn.getInputStream()));
        StringBuilder sb = new StringBuilder();
        String line;
        while ( ((line = br.readLine()) != null)) {
            if((line.indexOf("wsp:PolicyReference") == -1))
                sb.append(line+"\n");
        }
        br.close();
        System.out.println("Random code::"+sb.toString());

    } finally {
        if (conn != null) {
            conn.disconnect();
        }
    }

Answer 1

首先修改JDK安装的cacerts信任库是非常糟糕的做法，因为您将通过JDK更新来解除修改，该更新目前因漏洞而每周发布一次。

如果要使用已修改的Java信任库将其复制到项目中并从那里修改/使用它。

您的代码的主要问题（我假设）是您使用以下调用将协议限制为SSLv3：System.setProperty("https.protocols", "SSLv3");。

SSL3在某些情况下非常陈旧且不安全，因此您应该使用TLS v1.0或更高版本。如果服务器仅限于TLS（这里似乎是这种情况），则连接将失败。

因此，将"SSLv3"更改为"TLSv1"或"TLSv1.1"（"TLSv1.2"仅支持Java 7的AFAIR。）

与JAX-WS（部署在WL 10.3中）的Java ssl / https连接失败

1 个答案: