Question

我正在尝试在我的项目中启用SNI扩展。我通过以下方式设置jsse.enableSNIExtension属性： 1. Writing System.setProperty("jsse.enableSNIExtension", "true"); 2. Passing -Djsse.enableSNIExtension=true as VM argument

我在应用程序启动后打印了上述属性的值，并且打印的值是true，但是当tlsv1.2尝试与服务器建立握手时，sun.security.ssl.ClientHandshaker.java private static final boolean enableSNIExtension = Debug.getBooleanProperty("jsse.enableSNIExtension", true);中的字段具有值false，最终导致SNI标头未包含在扩展名中

日志显示以下内容：

http-nio-9113-exec-2, setSoTimeout(60000) called
http-nio-9113-exec-2, the previous server name in SNI (type=host_name (0), value=xxx.yyy.zzz.com) was replaced with (type=host_name (0), value=xxx.yyy.zzz.com)
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
.
.
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
%% No cached client session
update handshake state: client_hello[1]
upcoming handshake states: server_hello[2]
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1558202243 bytes = { 110, 67, 239, 138, 239, 2, 107, 13, 194, 64, 33, 49, 50, 105, 199, 255, 255, 238, 186, 205, 18, 178, 196, 116, 148, 207, 115, 200 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, .... TLS_DHE_DSS_WITH_AES_128_GCM_SHA256]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Extension extended_master_secret
Extension renegotiation_info, renegotiated_connection: <empty>
***

When getKickstartMessage() method is called in ClientHandshake.java, enableSNIExtension is set to false and hence serverNames is not set and requestedServerNames remains null.
                if (enableSNIExtension) {
                    if (this.session != null) {
                        this.requestedServerNames = this.session.getRequestedServerNames();
                    } else {
                        this.requestedServerNames = this.serverNames;
                    }

                    if (!this.requestedServerNames.isEmpty()) {
                        var11.addSNIExtension(this.requestedServerNames);
                    }
                }

请帮助解决此问题。任何线索都表示赞赏。

即使将jsse.enableSNIExtension设置为true，ClientHandshaker中的enableSNIExtension的值也为false

0 个答案: