在Tomcat上使用java.net.SocketException进行SSL握手失败

时间:2015-04-28 11:12:15

标签: tomcat grails ssl war

在Tomcat 7上作为WAR文件托管的Grails内部Web应用程序我有一个Web服务客户端,在SSL握手时失败,例外:

org.apache.cxf.interceptor.Fault: Could not send Message.

出于某种原因,使用'run-app'命令直接从Grails在dev / test环境中运行应用程序一切正常。

我使用Java属性-Djavax.net.debug=all启用了Tomcat 7上的SSL日志记录,我们收到了此错误:

http-bio-8080-exec-6, Exception while waiting for close java.net.SocketException: Software caused connection abort: recv failed
http-bio-8080-exec-6, handling exception: java.net.SocketException: Software caused connection abort: recv failed

Grails dev和Tomcat环境有什么区别?

我们正在使用Tomcat 7和Java 7,但在Tomcat 8和Java 8上测试的结果相同。 目标Web服务及其服务器是第三方,因此我无法控制它。

SSL握手日志的最后部分:

    *** ServerHelloDone
[read] MD5 and SHA1 hashes:  len = 4
0000: 0E 00 00 00                                        ....
*** Certificate chain
***
*** ClientKeyExchange, RSA PreMasterSecret, TLSv1
[write] MD5 and SHA1 hashes:  len = 269
0000: 0B 00 00 03 00 00 00 10   00 01 02 01 00 AD 3E 77  ..............>w
0010: 84 C1 68 E3 C1 D7 14 54   57 C0 50 52 9E 77 3B EC  ..h....TW.PR.w;.
0020: 4A A3 E7 D4 80 3F D6 E8   BE B4 7A EF 9F E5 5C C4  J....?....z...\.
0030: 61 29 3A AC A1 99 04 35   6C E0 0D ED 3D A7 01 38  a):....5l...=..8
0040: 91 90 60 2A 44 C1 32 4F   DF C2 F0 5D E3 59 D7 EB  ..`*D.2O...].Y..
0050: 47 9E EE E6 9C 1C B8 9B   DC 1D 31 37 3C AD F4 9C  G.........17<...
0060: 4A 39 A8 FE AF DB D6 9E   83 74 77 D8 CD 74 95 71  J9.......tw..t.q
0070: 62 2B 29 94 E4 60 CE B5   E9 C2 17 62 1F 8B 7B 37  b+)..`.....b...7
0080: E0 D1 79 7F 06 69 59 97   A4 75 89 3E B0 49 1F 0A  ..y..iY..u.>.I..
0090: 8B F6 3A FF 5F E9 E1 05   F0 B3 E5 48 4F 88 AE 38  ..:._......HO..8
00A0: 4F 51 1C 14 62 5E 4B 40   DF 2D 5A 2A F4 97 A8 29  OQ..b^K@.-Z*...)
00B0: 5C 0E 9C 5F 9A FF 18 BF   07 8D 69 1B 7D 72 5E D4  \.._......i..r^.
00C0: BD EE A3 87 DA 0A 1D C3   99 18 7E 36 07 2A 5B 5D  ...........6.*[]
00D0: 61 1B 4D 9B B9 57 4A 04   0E 99 35 8E 6C 21 C2 18  a.M..WJ...5.l!..
00E0: 44 D1 B7 4E 9C CE 03 9C   C9 65 2D 43 95 B2 44 27  D..N.....e-C..D'
00F0: D4 21 49 46 06 B4 05 CE   48 83 79 F1 DF 45 29 01  .!IF....H.y..E).
0100: AA 3D 62 97 DA E8 85 3B   4A 2A AE 2E AB           .=b....;J*...
http-bio-8080-exec-6, WRITE: TLSv1 Handshake, length = 269
[Raw write]: length = 274
0000: 16 03 01 01 0D 0B 00 00   03 00 00 00 10 00 01 02  ................
0010: 01 00 AD 3E 77 84 C1 68   E3 C1 D7 14 54 57 C0 50  ...>w..h....TW.P
0020: 52 9E 77 3B EC 4A A3 E7   D4 80 3F D6 E8 BE B4 7A  R.w;.J....?....z
0030: EF 9F E5 5C C4 61 29 3A   AC A1 99 04 35 6C E0 0D  ...\.a):....5l..
0040: ED 3D A7 01 38 91 90 60   2A 44 C1 32 4F DF C2 F0  .=..8..`*D.2O...
0050: 5D E3 59 D7 EB 47 9E EE   E6 9C 1C B8 9B DC 1D 31  ].Y..G.........1
0060: 37 3C AD F4 9C 4A 39 A8   FE AF DB D6 9E 83 74 77  7<...J9.......tw
0070: D8 CD 74 95 71 62 2B 29   94 E4 60 CE B5 E9 C2 17  ..t.qb+)..`.....
0080: 62 1F 8B 7B 37 E0 D1 79   7F 06 69 59 97 A4 75 89  b...7..y..iY..u.
0090: 3E B0 49 1F 0A 8B F6 3A   FF 5F E9 E1 05 F0 B3 E5  >.I....:._......
00A0: 48 4F 88 AE 38 4F 51 1C   14 62 5E 4B 40 DF 2D 5A  HO..8OQ..b^K@.-Z
00B0: 2A F4 97 A8 29 5C 0E 9C   5F 9A FF 18 BF 07 8D 69  *...)\.._......i
00C0: 1B 7D 72 5E D4 BD EE A3   87 DA 0A 1D C3 99 18 7E  ..r^............
00D0: 36 07 2A 5B 5D 61 1B 4D   9B B9 57 4A 04 0E 99 35  6.*[]a.M..WJ...5
00E0: 8E 6C 21 C2 18 44 D1 B7   4E 9C CE 03 9C C9 65 2D  .l!..D..N.....e-
00F0: 43 95 B2 44 27 D4 21 49   46 06 B4 05 CE 48 83 79  C..D'.!IF....H.y
0100: F1 DF 45 29 01 AA 3D 62   97 DA E8 85 3B 4A 2A AE  ..E)..=b....;J*.
0110: 2E AB                                              ..
SESSION KEYGEN:
PreMaster Secret:
0000: 03 01 8E 4C 97 8B D1 36   EB 9B A4 59 97 AC F9 75  ...L...6...Y...u
0010: 1F 3B 14 2A 7C B0 D1 FE   B8 15 DE 61 93 A7 84 AC  .;.*.......a....
0020: 5C 34 4D 4E 0D C1 19 FC   3F 42 38 77 4D FF 20 29  \4MN....?B8wM. )
CONNECTION KEYGEN:
Client Nonce:
0000: 55 3F 44 E3 2E 6E E7 A7   E1 19 9A 48 6E 14 B6 95  U?D..n.....Hn...
0010: C7 65 26 2B EB DE D8 44   C0 E1 70 68 56 AE 51 4D  .e&+...D..phV.QM
Server Nonce:
0000: 55 3F 44 E3 49 7C 29 23   32 9A 89 7B DC 7B C5 9E  U?D.I.)#2.......
0010: 26 2F FD A4 54 C4 8C C7   BD 9A 63 7E CE 7A 4E A1  &/..T.....c..zN.
Master Secret:
0000: 8E 77 FC 93 F7 7F A7 F8   4E B0 7F 46 91 0A D1 45  .w......N..F...E
0010: 21 6E 20 F0 F9 44 EB D4   06 64 7C 2D 4B 49 6F 0F  !n ..D...d.-KIo.
0020: E1 B7 93 2A 86 A8 7E CA   3E 7B 36 04 57 1E 3A 78  ...*....>.6.W.:x
Client MAC write Secret:
0000: 41 C8 49 3F 72 76 9B 54   CF 10 6C 84 39 FE BC F5  A.I?rv.T..l.9...
0010: 20 39 79 4C                                         9yL
Server MAC write Secret:
0000: 6B 57 51 ED 32 16 FE F4   17 3E 31 1B BE 03 40 8D  kWQ.2....>1...@.
0010: 6C 1F 1D F2                                        l...
Client write key:
0000: 60 72 62 0D DA B4 CC 3F   71 67 63 2B 3F BB AA A1  `rb....?qgc+?...
Server write key:
0000: 08 AE 2D DB EB E0 55 76   D7 F0 04 C2 AC E9 BD C5  ..-...Uv........
Client write IV:
0000: F8 44 FE 6D 70 61 AC 60   DF 21 A6 50 B4 44 A4 87  .D.mpa.`.!.P.D..
Server write IV:
0000: 03 BB E4 FB 9E 36 A3 DC   C7 EB D7 FA 5F 34 43 6D  .....6......_4Cm
http-bio-8080-exec-6, WRITE: TLSv1 Change Cipher Spec, length = 1
[Raw write]: length = 6
0000: 14 03 01 00 01 01                                  ......
*** Finished
verify_data:  { 156, 173, 59, 98, 213, 148, 56, 129, 171, 102, 102, 28 }
***
[write] MD5 and SHA1 hashes:  len = 16
0000: 14 00 00 0C 9C AD 3B 62   D5 94 38 81 AB 66 66 1C  ......;b..8..ff.
Padded plaintext before ENCRYPTION:  len = 48
0000: 14 00 00 0C 9C AD 3B 62   D5 94 38 81 AB 66 66 1C  ......;b..8..ff.
0010: EB B3 42 ED E3 DD A9 48   07 A2 FC A8 15 EE 34 AE  ..B....H......4.
0020: D1 B7 C2 75 0B 0B 0B 0B   0B 0B 0B 0B 0B 0B 0B 0B  ...u............
http-bio-8080-exec-6, WRITE: TLSv1 Handshake, length = 48
http-bio-8080-exec-6, waiting for close_notify or alert: state 1
http-bio-8080-exec-6, Exception while waiting for close java.net.SocketException: Software caused connection abort: recv failed
http-bio-8080-exec-6, handling exception: java.net.SocketException: Software caused connection abort: recv failed
%% Invalidated:  [Session-1, TLS_RSA_WITH_AES_128_CBC_SHA]
http-bio-8080-exec-6, SEND TLSv1 ALERT:  fatal, description = unexpected_message
Padded plaintext before ENCRYPTION:  len = 32
0000: 02 0A C4 92 83 43 07 2C   4F BB BB AD 4A 23 54 64  .....C.,O...J#Td
0010: 6D A5 68 33 F0 B9 09 09   09 09 09 09 09 09 09 09  m.h3............
http-bio-8080-exec-6, WRITE: TLSv1 Alert, length = 32
http-bio-8080-exec-6, Exception sending alert: java.net.SocketException: Software caused connection abort: socket write error
http-bio-8080-exec-6, called closeSocket()
http-bio-8080-exec-6, called close()
http-bio-8080-exec-6, called closeInternal(true)

经过更多调查后发现:我在'cxf-rt-frontend-jaxws.jar'中删除了'META-INF \ services \ javax.xml.ws.spi.Provider'文件的脏黑客”。这个jar依赖/插件强制SSL实现为'org.apache.cxf.jaxws22.spi.ProviderImpl'而不是默认的'com.sun.xml.ws.spi.ProviderImpl'。使用默认实现一切正常,但仍想知道正确的修复?

看起来'org.apache.cxf.jaxws22.spi.ProviderImpl'实现将证书发送到服务器,但不包括证书链,因此服务器拒绝接受我们的证书,但为什么?

0 个答案:

没有答案