Question

我必须用于我的应用程序的一个API仅支持TLS连接的ECDHE密码。

PORT    STATE SERVICE
443/tcp open  https
| ssl-enum-ciphers:
|   TLSv1.2:
|     ciphers:
|       TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 (rsa 2048) - A
|       TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256 (rsa 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 (rsa 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 (rsa 2048) - A
|       TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 (rsa 2048) - A
|     compressors:
|       NULL
|     cipher preference: server
|_  least strength: A

已完成Nmap：在15.16秒内扫描了1个IP地址（1个主机已启动）

我的应用似乎不支持这些应用，我得到了：

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

这是我可以在日志中看到的密码列表：

"ClientHello": {
  "client version"      : "TLSv1.2",
  "random"              : "FE 6E D4 06 07 51 D0 66 1A 6A B8 60 84 B0 C7 9F 07 82 8F 92 13 48 2A 72 DC BD 80 39 B9 33 7A 1D",
  "session id"          : "8C 37 D0 37 88 6C D6 5C 59 94 5B AD E6 6E 0F 50 1D F2 9E 06 F6 17 3F 85 44 AB 12 82 E1 1F F5 53",
  "cipher suites"       : "[TLS_AES_256_GCM_SHA384(0x1302), TLS_AES_128_GCM_SHA256(0x1301), TLS_CHACHA20_POLY1305_SHA256(0x1303), TLS_DHE_RSA_WITH_AES_256_GCM_SHA384(0x009F), TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256(0xCCAA), TLS_DHE_DSS_WITH_AES_256_GCM_SHA384(0x00A3), TLS_DHE_RSA_WITH_AES_128_GCM_SHA256(0x009E), TLS_DHE_DSS_WITH_AES_128_GCM_SHA256(0x00A2), TLS_DHE_RSA_WITH_AES_256_CBC_SHA256(0x006B), TLS_DHE_DSS_WITH_AES_256_CBC_SHA256(0x006A), TLS_DHE_RSA_WITH_AES_128_CBC_SHA256(0x0067), TLS_DHE_DSS_WITH_AES_128_CBC_SHA256(0x0040), TLS_DHE_RSA_WITH_AES_256_CBC_SHA(0x0039), TLS_DHE_DSS_WITH_AES_256_CBC_SHA(0x0038), TLS_DHE_RSA_WITH_AES_128_CBC_SHA(0x0033), TLS_DHE_DSS_WITH_AES_128_CBC_SHA(0x0032), TLS_RSA_WITH_AES_256_GCM_SHA384(0x009D), TLS_RSA_WITH_AES_128_GCM_SHA256(0x009C), TLS_RSA_WITH_AES_256_CBC_SHA256(0x003D), TLS_RSA_WITH_AES_128_CBC_SHA256(0x003C), TLS_RSA_WITH_AES_256_CBC_SHA(0x0035), TLS_RSA_WITH_AES_128_CBC_SHA(0x002F), TLS_EMPTY_RENEGOTIATION_INFO_SCSV(0x00FF)]",

还有我的Dockerfile

FROM alpine:3.10 as jdk-14-alpine

# Add the musl-based JDK 14 distribution
RUN apk update \
    && apk add wget \
    && apk --no-cache add ca-certificates

RUN wget -q https://download.java.net/java/early_access/alpine/12/binaries/openjdk-14-ea+12_linux-x64-musl_bin.tar.gz && \
    echo "f6247b208eae214562ec69ec928a238ec26a15b7d18a435523c3ceb3f3f18a7c *openjdk-14-ea+12_linux-x64-musl_bin.tar.gz" | sha256sum -c -
RUN tar -x -f openjdk-14-ea+12_linux-x64-musl_bin.tar.gz -C /opt
RUN rm openjdk-14-ea+12_linux-x64-musl_bin.tar.gz

# Set up env variables
ENV JAVA_HOME=/opt/jdk-14
ENV PATH=$PATH:$JAVA_HOME/bin

# Strip away unnecessary parts of the JDK
# The java.desktop module is needed because Jersey's RenderedImageProvider references java.awt.image.RenderedImage
# The java.sql module is needed because Snakeyaml's Tag references java.sql.Date

RUN jlink --module-path /opt/jdk-14/jmods \
    --add-modules java.base,java.logging,java.xml,jdk.unsupported,java.desktop,java.management,java.naming,java.sql,jdk.jdi,jdk.jdwp.agent \
    --compress 2 \
    --no-header-files \
    --output /opt/jdk-14-alpine-linked

CMD ["/opt/jdk-14-alpine-linked/bin/java", "-version"]

FROM alpine:3.10

# Copy the stripped JDK 14 from the previous stage
COPY --from=jdk-14-alpine /opt/jdk-14-alpine-linked /opt/jdk-14
COPY --from=jdk-14-alpine /opt/jdk-14-alpine-linked /opt/jre-14
ENV JAVA_HOME=/opt/jre-14
ENV PATH=$PATH:$JAVA_HOME/bin

# Add the application jar file
ADD target/app-backend.jar /opt/app/app-backend.jar

ADD run.sh /opt/app/run.sh
RUN chmod +x /opt/app/run.sh


CMD ["sh", "/opt/app/run.sh"]

我试图通过添加

来实现无限的安全性

Security.setProperty("crypto.policy", "unlimited");

但这并没有改变。我还尝试在pom文件中添加bouncycastle，反而得到：

Caused by: java.lang.RuntimeException: Could not generate XDH keypair

可以通过应用here中描述的解决方案来解决此问题，但是我又回到了最初的错误。

关于我能做什么的任何想法？我在本地计算机上工作，只有在部署后才会出现问题。

此应用程序使用Apache http，因此一种替代方法是直接在该级别注入对这些密码的支持。能做到吗？

Answer 1

这实际上与Alpine或OpenJDK 14没有关系。我在http://www.gubatron.com/blog/2019/04/25/solving-received-fatal-alert-handshake_failure-error-when-performing-https-connections-on-a-custom-made-jre-with-jlink/找到了解决方案，只需将jdk.crypto.cryptoki添加到要通过jlink添加的模块列表中

如何在Alpine Docker容器上使用openjdk 14启用ECDHE密码？

1 个答案: