这似乎倒退了，但是我正在开发专门用于与第三方客户端交互的Web服务器。该第三方客户端仅支持SSLv3，TLSv1.0或TLSv1.1。
当他们尝试连接时，我也看到以下错误：
SSLHandshakeException: SSLv2Hello is not enabled
我认为这意味着它们还需要启用SSLv2Hello。尽管它似乎可用，但显然不适合我。
2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Protocols [TLSv1.1, TLSv1] of [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Ciphers [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] of [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
不确定这是否是一条红色鲱鱼，但是如果我尝试对SSLContext.getInstances执行以下操作，则TLSv1.1调用可以正常工作，SSLv2Hello会引发NoSuchAlgorithmException。
SSLContext.getInstance( "TLSv1.1" )
SSLContext.getInstance( "SSLv2Hello" )
自从我进行原型制作以来，我正在运行的用于将其旋转的代码仍然是一团糟，但要了解我正在做的要务，它仍然在下面。
final String url = "https://myurl.com:443/Notices";
TLSServerParameters params = new TLSServerParameters();
List<String> certFilePaths = new ArrayList<>();
certFilePaths.add( "COMODORSADomainValidationSecureServerCA.crt" );
certFilePaths.add( "AddTrustExternalCARoot.crt" );
certFilePaths.add( "COMODORSAAddTrustCA.crt" );
certFilePaths.add( "MyCert.crt" );
Utility.loadCertsToServerParams( certFilePaths, "SSL_Export.pfx", "/tmp/tmp.jks", "password", params ); //uses the ssl password as the temporary keystore password as well
JettyHTTPServerEngineFactory serverEngineFactory = new JettyHTTPServerEngineFactory();
serverEngineFactory.setTLSServerParametersForPort( 443, params );
Consumer implementor = new Consumer();
JaxWsServerFactoryBean factory = new JaxWsServerFactoryBean();
factory.setServiceClass( Consumer.class );
factory.setAddress( url );
factory.setServiceBean( implementor );
Map<String, Object> properties = Maps.newHashMap();
properties.put( "mtom-enabled", "false" );
factory.setProperties( properties );
final Map<String, Object> inProps = Utility.getWsSecurityPropertiesForSSL( "/tmp/tmp.jks", "SSL_Export.pfx", "password", "SSL_Export" );
WSS4JInInterceptor wssOut = new WSS4JInInterceptor( inProps );
factory.getInInterceptors().add( wssOut );
ServerImpl server = ( ServerImpl ) factory.create();
server.start();
public static TrustManager[] loadCertsToServerParams( List<String> serverCertFilePaths, String sslTlsKeyPairPath, String tempPathForCertFileKeystore, String sslTslKeyPairPassword, TLSServerParameters params ) throws Exception
{
char[] sslTslKeyPairPasswordCharArray = sslTslKeyPairPassword.toCharArray();
//clear out the keystore, we create a new one every time
if( Files.exists( Paths.get( tempPathForCertFileKeystore ) ) )
Files.delete( Paths.get( tempPathForCertFileKeystore ) );
KeyStore ks = KeyStore.getInstance( "PKCS12" );
ks.load( new FileInputStream( sslTlsKeyPairPath ), sslTslKeyPairPasswordCharArray );
// Store away the newly created keystore.
FileOutputStream fos = new FileOutputStream( tempPathForCertFileKeystore );
ks.store( fos, sslTslKeyPairPasswordCharArray );
fos.close();
for( String certFilePath : serverCertFilePaths )
AddCertToKeystore( ks, sslTslKeyPairPasswordCharArray, tempPathForCertFileKeystore, certFilePath, new File( certFilePath ).getName().replace( '.', '_' ) );
TrustManagerFactory tmf = TrustManagerFactory.getInstance( TrustManagerFactory.getDefaultAlgorithm() );
tmf.init( ks );
KeyManagerFactory kmf = KeyManagerFactory.getInstance( KeyManagerFactory.getDefaultAlgorithm() );
kmf.init( ks, sslTslKeyPairPasswordCharArray );
SSLContext tls1_1Context = SSLContext.getInstance( "TLSv1.1" );
tls1_1Context.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
SSLContext.setDefault( tls1_1Context );
SSLContext v2Hello = SSLContext.getInstance( "SSL" );
v2Hello.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
params.setTrustManagers( tmf.getTrustManagers() );
params.setKeyManagers( kmf.getKeyManagers() );
params.setSecureSocketProtocol( "SSL" );
final List<String> additionalProtocols = new ArrayList<>();
additionalProtocols.add( "SSLv2Hello" );
additionalProtocols.add( "SSLv3" );
additionalProtocols.add( "TLSv1" );
additionalProtocols.add( "TLSv1.1" );
additionalProtocols.add( "TLSv1.2" );
params.setIncludeProtocols( additionalProtocols );
params.setExcludeProtocols( null );
final FiltersType cipherFilter = new FiltersType();
cipherFilter.getInclude().add( ".*NULL.*" );
cipherFilter.getInclude().add( ".*anon.*" );
cipherFilter.getInclude().add( ".*EXPORT.*" );
cipherFilter.getInclude().add( ".*DES.*" );
cipherFilter.getInclude().add( ".*MD5" );
cipherFilter.getInclude().add( ".*CBC.*" );
cipherFilter.getInclude().add( ".*RC4.*" );
cipherFilter.getInclude().add( ".*_.*" );
cipherFilter.getInclude().add( ".*AES.*" );
cipherFilter.getInclude().add( ".*_SHA" );
cipherFilter.getExclude().add( "" );
params.setCipherSuitesFilter( cipherFilter );
final List<String> cipherSuites = new ArrayList<>();
cipherSuites.add( "TLS_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" );
params.setCipherSuites( cipherSuites );
return tmf.getTrustManagers();
}
我正在明确设置SSLv2Hello作为Jetty github问题中建议的附加协议，要启用SSLv2Hello，我缺少什么？
答案 0 :(得分：0)
这似乎是CXF错误。如果我基于源副本创建自己的JettyHTTPServerEngine并添加以下行：
scf.setIncludeProtocols( "TLSv1", "TLSv1.1", "TLSv1.2", "SSLv2Hello" );
此方法：
protected SSLContext createSSLContext( SslContextFactory scf) throws Exception
然后行为与我预期的一样，其中调试输出表明现在支持这些协议，并且连接成功。
[TLSv1.3]的选定协议[TLSv1，TLSv1.1，TLSv1.2，SSLv2Hello]， TLSv1.2，TLSv1.1，TLSv1，SSLv3，SSLv2您好]
在我的3.2.4版本或GitHub的master版本中，原始JettyHTTPServerEngine代码中的任何地方都看不到setIncludeProtocols函数，因此我无法想象它是如何工作或应该如何工作。