javax.net.ssl.SSLHandshakeException: No appropriate protocol

问题:

i have install tomcat 8(ssl support) with java 1.8. When start tomcat catalina out write

javax.net.ssl.SSLHandshakeException: No appropriate protocol (protocol is disabled or cipher suites are inappropriate) at sun.security.ssl.Handshaker.activate(Handshaker.java:503) at sun.security.ssl.SSLEngineImpl.kickstartHandshake(SSLEngineImpl.java:729) at sun.security.ssl.SSLEngineImpl.beginHandshake(SSLEngineImpl.java:756) at org.apache.tomcat.util.net.SecureNioChannel.reset(SecureNioChannel.java:94) at org.apache.tomcat.util.net.SecureNioChannel.<init>(SecureNioChannel.java:76) at org.apache.tomcat.util.net.NioEndpoint.setSocketOptions(NioEndpoint.java:544) at org.apache.tomcat.util.net.NioEndpoint$Acceptor.run(NioEndpoint.java:697) at java.lang.Thread.run(Thread.java:745) 

and this

12-Dec-2016 14:12:37.297 WARNING [main] org.apache.tomcat.util.net.jsse.JSSESocketFactory.getEnableableProtocols None of the SSL protocols specified are supported by the SSL engine : [TLSv1+TLSv1.1+TLSv1.2] 

With old version of tomcat and java errors don't occur.

My server.xml configuration

    <Connector port="443" protocol="HTTP/1.1" SSLEnabled="true"                maxThreads="700" scheme="https" secure="true"                clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1+TLSv1.1+TLSv1.2" keystoreFile="/var/lib/tomcat8/keystore" keystorePass="********" keystoreType="JKS" keyAlias="tomcat" ciphers="TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_EXPORT1024_WITH_RC4_56_MD5, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_RSA_WITH_RC4_128_MD5, TLS_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_DES_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA, TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA" /> 

What could be the problem? Thanks

回答1:

From the Apache Tomcat 8 Configuration Reference, sslEnabledProtocols should represent

The comma separated list of SSL protocols to support for HTTPS connections.

The Apache Tomcat 8 - Security Considerations document has an example indicating the correct usage of this parameter -- sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2". You have this incorrectly specified to use + instead of , -- TLSv1+TLSv1.1+TLSv1.2.

文章来源: javax.net.ssl.SSLHandshakeException: No appropriate protocol