我有一个包含在嵌入式码头上运行的REST API的Sping Boot 应用程序。我试图通过在TLSv1上运行的另一个Java应用程序来命中它,但出现以下错误:
致命错误:引擎已关闭。正在重新抛出javax.net.ssl.SSLHandshakeException:Sping Boot 嵌入式Jetty服务器上没有通用的密码套件
我已检查服务器证书别名,并且已正确配置。在客户端,我收到以下网络调试日志:
pool-2-thread-1, READ: TLSv1 Alert, length = 2
pool-2-thread-1, RECV TLSv1.2 ALERT: fatal, handshake_failure
pool-2-thread-1, called closeSocket()
pool-2-thread-1, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
客户端似乎希望连接到TLSv1,但服务器( Spring Boot 码头)希望连接到TLSv1.2。我已尝试使用www.example.com文件中的以下配置在码头上使用TLSv1application.properties:
server.ssl.enabled=true
server.ssl.enabled-protocols=TLSv1
server.ssl.disabled-protocols=TLSv1.2
server.ssl.protocol=TLS
server.ssl.disabled-cipher-suites=
server.ssl.key-store-type=JKS
server.ssl.keystore=keystore_path
server.ssl.key-store-password=password
server.ssl.key-alias=alias_name
trust.store=truststore_path
trust.store.password=password
但我猜他们不工作。请建议。以下是来自服务器端的网络调试日志:
Using SSLEngineImpl.
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_GCM_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
[Raw read]: length = 5
0000: 16 03 01 00 63 ....c
[Raw read]: length = 99
0000: 01 00 00 5F 03 01 63 AE A7 33 45 C3 64 64 C9 BD ..._..c..3E.dd..
0010: BD 19 74 DA 21 29 8C 62 6B FB 32 67 86 C6 9A E0 ..t.!).bk.2g....
0020: 91 04 3C 85 84 83 00 00 1E 00 FF C0 0A C0 14 00 ..<.............
0030: 35 C0 05 C0 0F 00 39 00 38 C0 09 C0 13 00 2F C0 5.....9.8...../.
0040: 04 C0 0E 00 33 00 32 01 00 00 18 00 0A 00 0A 00 ....3.2.........
0050: 08 00 17 00 18 00 19 00 16 00 0B 00 02 01 00 00 ................
0060: 17 00 00 ...
qtp1209702763-21, READ: TLSv1 Handshake, length = 99
*** ClientHello, TLSv1
RandomCookie: GMT: 1655547699 bytes = { 69, 195, 100, 100, 201, 189, 189, 25, 116, 218, 33, 41, 140, 98, 107, 251, 50, 103, 134, 198, 154, 224, 145, 4, 60, 133, 132, 131 }
Session ID: {}
Cipher Suites: [TLS_EMPTY_RENEGOTIATION_INFO_SCSV, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA]
Compression Methods: { 0 }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Unsupported extension type_23, data:
***
[read] MD5 and SHA1 hashes: len = 99
0000: 01 00 00 5F 03 01 63 AE A7 33 45 C3 64 64 C9 BD ..._..c..3E.dd..
0010: BD 19 74 DA 21 29 8C 62 6B FB 32 67 86 C6 9A E0 ..t.!).bk.2g....
0020: 91 04 3C 85 84 83 00 00 1E 00 FF C0 0A C0 14 00 ..<.............
0030: 35 C0 05 C0 0F 00 39 00 38 C0 09 C0 13 00 2F C0 5.....9.8...../.
0040: 04 C0 0E 00 33 00 32 01 00 00 18 00 0A 00 0A 00 ....3.2.........
0050: 08 00 17 00 18 00 19 00 16 00 0B 00 02 01 00 00 ................
0060: 17 00 00 ...
%% Initialized: [Session-3, SSL_NULL_WITH_NULL_NULL]
qtp1209702763-21, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated: [Session-3, SSL_NULL_WITH_NULL_NULL]
qtp1209702763-21, SEND TLSv1 ALERT: fatal, description = handshake_failure
qtp1209702763-21, WRITE: TLSv1 Alert, length = 2
qtp1209702763-21, fatal: engine already closed. Rethrowing
javax.net.ssl.SSLHandshakeException: no cipher suites in common
qtp1209702763-21, called closeOutbound()
qtp1209702763-21, closeOutboundInternal()
1条答案
按热度按时间ttp71kqs1#
TLSv 1也被Java禁用。
在Java上启用TLSv 1协议(以及TLSv 1所需的密码套件)还需要做很多工作。
在Jetty端,简单地不指定禁用的密码套件不会在Java端启用已经禁用的密码套件。
有关特定Java版本上Crypto的状态,请参见https://www.java.com/en/jre-jdk-cryptoroadmap.html。
您在服务器证书中的选择(使用的加密、位长等)也会影响您使用TLS/1.0或TLS/1.1的能力,因为现代浏览器的建议与TLS/1.0和TLS/1.1所需的密码套件越来越不兼容。