Question

我正在努力将Apache NiFi的OkHttp版本从2.5更新到2.6。这样做时，所有HTTPS测试都会因此异常而失败：

javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake

测试使用Jetty服务器周围的包装器作为它连接的主机。信任库和密钥库对于主机和客户端是相同的。由于某种原因，从2.5到2.6的变化导致服务器提前关闭。

我唯一改变的是Maven中的OkHttp版本，从2.5到2.6。测试类在这里（实现在TestInvokeHttpCommon中）： https://github.com/apache/nifi/blob/8c2323dc8d0e107f1a99898370c7515fa9603122/nifi-nar-bundles/nifi-standard-bundle/nifi-standard-processors/src/test/java/org/apache/nifi/processors/standard/TestInvokeHttpSSL.java

Answer 1

问题确实是一个特定的密码套件ConnectionSpec从新版本的OkHttp中被淘汰。要解决此问题，代码可用于提供@JesseWilson建议的自定义ConnectionSpec.Builder obsoleteSpecBuilder = new ConnectionSpec.Builder(ConnectionSpec.COMPATIBLE_TLS); obsoleteSpecBuilder = obsoleteSpecBuilder.cipherSuites("TLS_DHE_DSS_WITH_AES_128_CBC_SHA"); ConnectionSpec obsoleteSpec = obsoleteSpecBuilder.build(); okHttpClient.setConnectionSpecs(Arrays.asList(obsoleteSpec));实例。

TLS_*DSS*

然而，根本问题是Jetty使用的密钥库和信任库没有任何有效的RSA或DSA密钥（有一个DSA密钥但它在2年前过期。显然日期检查在以前的测试中没有激活）。如果没有这些密钥，Jetty将无法提供任何依赖于RSA / DSA的密码套件，因此一旦删除了hw12203:...src/test/resources alopresto 10s @ 12:43:08 $ keytool -genkey -keyalg RSA -alias localhost -keystore localhost-ks.jks -validity 360 -keysize 2048 Enter keystore password: What is your first and last name? [Unknown]: localhost What is the name of your organizational unit? [Unknown]: Apache NiFi What is the name of your organization? [Unknown]: Apache What is the name of your City or Locality? [Unknown]: Santa Monica What is the name of your State or Province? [Unknown]: CA What is the two-letter country code for this unit? [Unknown]: US Is CN=localhost, OU=Apache NiFi, O=Apache, L=Santa Monica, ST=CA, C=US correct? [no]: yes Enter key password for <localhost> (RETURN if same as keystore password): hw12203:...src/test/resources alopresto 23s @ 12:46:09 $ keytool -exportcert -alias localhost -file localhost.der -keystore localhost-ks.jks Enter keystore password: Certificate stored in file <localhost.der> hw12203:...src/test/resources alopresto 2s @ 12:46:34 $ keytool -import -alias localhost -file localhost.der -keystore localhost-ts.jks Enter keystore password: Owner: CN=localhost, OU=Apache NiFi, O=Apache, L=Santa Monica, ST=CA, C=US Issuer: CN=localhost, OU=Apache NiFi, O=Apache, L=Santa Monica, ST=CA, C=US Serial number: 6f3e5921 Valid from: Tue Jan 05 12:46:04 PST 2016 until: Fri Dec 30 12:46:04 PST 2016 Certificate fingerprints: MD5: 9F:CE:78:6D:18:0B:CF:7D:57:50:02:10:BA:98:27:62 SHA1: FA:70:D1:5C:BE:90:D3:CA:A0:3D:5E:67:62:D1:25:F6:31:2E:59:31 SHA256: A8:09:89:7C:19:6E:05:5B:CB:04:09:2C:30:5B:35:85:23:0F:C6:8A:12:00:4C:9F:39:5E:40:43:86:3E:FB:09 Signature algorithm name: SHA256withRSA Version: 3 Extensions: #1: ObjectId: 2.5.29.14 Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: AB 88 BA FA F7 F5 AE 22 69 E4 B6 89 3D FB B0 61 ......."i...=..a 0010: 30 95 A3 27 0..' ] ] Trust this certificate? [no]: yes Certificate was added to keystore密码套件，客户端就没有兼容的密码套件。

将RSA密钥添加到密钥库和信任库可以解决此问题，而无需依赖旧密码套件。

XHR

OkHttp从2.5升级到2.6会破坏HTTPS测试

1 个答案: