我正在尝试连接到启用了SSL的LDAP服务器。我不想使用身份验证，因此我已经覆盖了SSLSocketFactory以允许每个站点。我收到了以下错误：
main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: **handshake_failure**
javax.naming.CommunicationException: slc00ahj.us.oracle.com:3131 Root exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at com.sun.jndi.ldap.Connection.<init>(Connection.java:209)
at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:116)
at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1582)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2678)
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:296)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
at javax.naming.InitialContext.init(InitialContext.java:223)
at javax.naming.InitialContext.<init>(InitialContext.java:197)
at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
at SumanLdapTest1.main(SumanLdapTest1.java:37)
SSL日志为：
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
main, setSoTimeout(120) called
%% No cached client session
ClientHello, TLSv1
RandomCookie: GMT: 1357201614 bytes = { 70, 133, 164, 224, 89, 101, 204, 41, 107, 201, 176, 66, 93, 118, 139, 59, 50, 176, 84, 197, 238, 236, 187, 211, 158, 43, 159, 112 }
Session ID: {}
Cipher Suites: SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV
Compression Methods: { 0 }
***
**main, WRITE: TLSv1 Handshake, length = 75
main, READ: TLSv1 Alert, length = 2
main, RECV TLSv1 ALERT: fatal, handshake_failure
main, called closeSocket()**
**My source code:**
public class **SumanLdapTest1**{
public static void main(String args[]){
try{
//System.setProperty("ldaps.protocols", "TLSv1");
System.out.println("here");
DirContext ctx = null;
String host="slc00ahj.us.oracle.com";
String port="3131";
String userName="cn=orcladmin";
String password="welcome1";
Hashtable<String, String> env = new Hashtable<String, String>();
env.put(Context.INITIAL_CONTEXT_FACTORY,
"com.sun.jndi.ldap.LdapCtxFactory");
//env.put(Context.PROVIDER_URL, "ldap://" + host + ":"+ port+ "/");
env.put(Context.SECURITY_PRINCIPAL, userName);
env.put(Context.SECURITY_CREDENTIALS, password);
env.put(Context.SECURITY_AUTHENTICATION, "simple");
env.put("com.sun.jndi.ldap.connect.timeout", "120");
env.put(Context.PROVIDER_URL, "ldaps://" + host
+ ":" + port);
env.put(Context.SECURITY_PROTOCOL, "ssl");
env.put("java.naming.ldap.factory.socket","**SumanSSLFactory**");
ctx = new InitialDirContext(env);
}catch(Exception e){
e.printStackTrace();
}
}
}
public class SumanSSLFactory extends SSLSocketFactory {
private SSLSocketFactory factory = null;
private Exception exception = null;
public SumanSSLFactory() {
System.out.println("LdapSSLFactory initialization started...");
try {
this.factory = **getSSLSocketFactory**();
} catch (Exception ex) {
ex.printStackTrace();
System.out.println("LDAPSSLFactory Initialization error");
this.factory = null;
this.exception = ex;
}
System.out.println("LdapSSLFactory Initialization completed.");
}
public SSLSocket createSocket() throws IOException {
System.out.println("LdapSSLFactory.createSocket()");
if (this.factory == null)
throw new IOException();
SSLSocket st=null;
try{
(new Throwable()).printStackTrace();
st=(SSLSocket)this.factory.createSocket();
st.setEnabledProtocols( new String[] { "TLSv1", "SSLv3" } );
}catch(Exception e){
e.printStackTrace();
}
return st;
}
private SSLSocketFactory **getSSLSocketFactory**()
{
SSLSocketFactory sslSocketFactory = null;
System.out.println("Using Non Authenticated SSL Mechanism.");
try {
TrustManager[] tmA = { new X509TrustManager() {
public X509Certificate[] getAcceptedIssuers() {
X509Certificate[] issuers = new X509Certificate[0];
return issuers;
//return null;
}
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
}
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws CertificateException {
}
} };
// get the SSLContext and factory
SSLContext ctx = SSLContext.getInstance("TLS");
ctx.init(null, tmA, null);
sslSocketFactory = ctx.getSocketFactory();
// System.setProperty("ldaps.protocols", "TLSv1");
System.out.println("SSOSocketUtil factory created sslSocketFactory"+sslSocketFactory);
} catch (Exception ex) {
ex.printStackTrace();
System.out.println("SSOSocketUtil factory exception");
}
return sslSocketFactory;
}
}
Any help on this will be appreciated
答案 0 :(得分：2)
我会在不使用你的代码进行测试的情况下进行测试。例如，尝试使用其中一个LDAP Utils二进制文件测试某种SSL操作（例如：ldapsearch，ldapwhoami等）。确保SSL / TLS以这种方式工作。
如果它不起作用，请检查本地系统LDAP设置，并检查服务器使用的证书是否已过期且未自签名（允许自签名证书，但需要进一步配置）。
此外，请确保服务器正在通过LDAPS而非LDAP侦听您的特殊端口（3131？）。如果常规LDAP用于侦听器，则不支持SSL，但支持TLS（StartTLS）。请注意，LDAP SSL在技术上已弃用，以支持TLS。如果您能够使用TLS而不是SSL，那么您应该这样做。
最后在服务器端，确保RootDSE显示TLS / SSL支持的OID（1.3.6.1.4.1.1466.20037）。如果您没有看到这一点，那么服务器不支持SSL / TLS（至少对于OpenLDAP来说这是真的）。
如果命令行二进制测试有效，那么我将不得不假设代码本身或代码运行的HOST上的系统LDAP设置。或两者。
我对JAVA并不娴熟（但根本没有），但无论如何我都查看了你的代码并没有看到任何明显错误的内容。如果代码本身存在直接问题，那我就错了。=）
如果无法修复代码，请尽可能尝试修改代码，以免使用SSL / TLS。至少你可以确定你的代码的预期功能，而不是安全的传输。这至少可以显着缩小范围。当然，如果此类测试存在安全问题，您可能需要做出特殊安排（例如：使用stunnel，或在LDAP服务器上本地运行脚本等）。
我希望这会有所帮助......
最高