Question

我正在尝试构建Java代码并运行jar文件。我使用Java 1.8.0_201运行jar，但是由于握手失败，运行Java时无法从服务器生成令牌。发生这种情况的主要原因是协议不匹配。（客户端在TLSv1中发送请求，服务器在TLSv1.2中返回，导致协议不匹配）

问题是为什么Java 1.8在默认值为TLSv1.2时使用TLSv1。我已经检查了/jre/lib/security/java.security文件，那里的配置似乎还不错。

Ignoring unsupported cipher suite: SSL_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: SSL_ECDH_RSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_128_GCM_SHA256
%% No cached client session
ALPNJSSEExt not initialzed for Client
*** ClientHello, TLSv1
RandomCookie:  GMT: 1538275877 bytes = { 241, 176, 51, 175, 86, 198, 212, 80, 127, 148, 227, 71, 225, 187, 76, 30, 151, 32, 213, 28, 179, 237, 196, 200, 111, 252, 126, 198 }
Session ID:  {}
Cipher Suites: [SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_AES_256_CBC_SHA, SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_AES_128_CBC_SHA, SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_DSS_WITH_AES_128_CBC_SHA]
Compression Methods:  { 0 }
Extension renegotiation_info, ri_length: 0, ri_connection_data: { null }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension extended_master_secret
Extension server_name, server_name: [type=host_name (0), value=<>]
***
[write] MD5 and SHA1 hashes:  len = 140
0000: 01 00 00 88 03 01 5c b0  3a 25 f1 b0 33 af 56 c6  ............3.V.
0010: d4 50 7f 94 e3 47 e1 bb  4c 1e 97 20 d5 1c b3 ed  .P...G..L.......
0020: c4 c8 6f fc 7e c6 00 00  1c c0 0a c0 14 00 35 c0  ..o...........5.
0030: 05 c0 0f 00 39 00 38 c0  09 c0 13 00 2f c0 04 c0  ....9.8.........
0040: 0e 00 33 00 32 01 00 00  43 ff 01 00 01 00 00 0a  ..3.2...C.......
0050: 00 0a 00 08 00 17 00 18  00 19 00 16 00 0b 00 02  ................
0060: 01 00 00 17 00 00 00 00  00 22 00 20 00 00 1d 73  ...............
0070: 64 70 2d 63 77 73 2e 73  64 70 31 32 2d 69 73 74  
0080: 67 2e 63 73 63 6f 2e 63  6c 6f 75 64              

main, WRITE: TLSv1 Handshake, length = 140
[Raw write]: length = 145
0000: 16 03 01 00 8c 01 00 00  88 03 01 5c b0 3a 25 f1  ................
0010: b0 33 af 56 c6 d4 50 7f  94 e3 47 e1 bb 4c 1e 97  .3.V..P...G..L..
0020: 20 d5 1c b3 ed c4 c8 6f  fc 7e c6 00 00 1c c0 0a  .......o........
0030: c0 14 00 35 c0 05 c0 0f  00 39 00 38 c0 09 c0 13  ...5.....9.8....
0040: 00 2f c0 04 c0 0e 00 33  00 32 01 00 00 43 ff 01  .......3.2...C..
0050: 00 01 00 00 0a 00 0a 00  08 00 17 00 18 00 19 00  ................
0060: 16 00 0b 00 02 01 00 00  17 00 00 00 00 00 22 00  ................
0070: 20 00 00 1d 73 64 70 2d  63 77 73 2e 73 64 70 31  ....
0080: 32 2d 69 73 74 67 2e 63  73 63 6f 2e 63 6c 6f 75  
0090: 64                                                 

[Raw read]: length = 5
0000: 15 03 01 00 02                                     .....

[Raw read]: length = 2
0000: 02 46                                              .F

main, READ: TLSv1 Alert, length = 2
main, RECV TLSv1.2 ALERT:  fatal, protocol_version
main, called closeSocket()
main, handling exception: javax.net.ssl.SSLException: Received fatal alert: protocol_version

clientHello应该列出TLSv1.2，但是为什么显示TLSv1？由于客户端支持TLSv1.2，而且我正在使用java1.8

Answer 1

我曾经遇到过API的相同问题，该API曾经使用SSL连接与第三方提供商交换数据。简而言之，我禁用了较低级别的安全算法。此设置强制服务器仅接受TLSv1.2连接。

jdk.tls.disabledAlgorithms= SSLv2Hello, SSLv3, TLSv1, TLSv1.1

在 jre / lib / security / java.security 文件中添加此参数应该可以解决您的问题。

javax.net.ssl.SSLException：收到致命警报：protocol_version，使用TLSv1进行握手而不是默认TLSv1.2的Java1.8.0_201

1 个答案: