Java SSL SSLHandshakeException handshake_failure

匿名 (未验证) 提交于 2019-12-03 07:36:14

问题:

I am using java 8 and requesting with SSLSocket this url: https://www.flixbus.de/sites/default/files/6_jetzt_buchen_button_tiny.png

I always get a handshake error. socket.setEnabledProtocols() to force use of a specific protocol didn't help.

Btw, all other web servers work fine. So it's probably not related to my code.

This error also occurs without any ssl/tls protocol restriction.

Any ideas?

The output with option "javax.net.debug=all" is as follows:

DEBG getSecureScocket: Supported protocols: - SSLv2Hello - SSLv3 - TLSv1 - TLSv1.1 - TLSv1.2 DEBG getSecureScocket: Enabled protocols: - TLSv1.2 Http Client, setSoTimeout(120000) called Allow unsafe renegotiation: false Allow legacy hello messages: true Is initial handshake: true Is secure renegotiation: false  %% No cached client session *** ClientHello, TLSv1.2 RandomCookie:  GMT: 1426330417 bytes = { 229, 161, 185, 11, 136, 85, 35, 88, 166, 144, 191, 126, 10, 196, 215, 241, 43, 190, 221, 246, 240, 217, 82, 29, 180, 106, 35, 253 } Session ID:  {} Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_ AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH _AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_A ES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WIT H_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WIT H_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_12 8_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] Compression Methods:  { 0 } Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r 2, secp224k1, sect239k1, secp256k1} Extension ec_point_formats, formats: [uncompressed] Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA25 6withRSA, SHA224withECDSA, SHA224withRSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA, MD5withRSA *** [write] MD5 and SHA1 hashes:  len = 193 [Raw write]: length = 198 [Raw read]: length = 5 [Raw read]: length = 2 Http Client, READ: TLSv1.2 Alert, length = 2 Http Client, RECV TLSv1.2 ALERT:  fatal, handshake_failure Http Client, called closeSocket() Http Client, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure Http Client, called close() Http Client, called closeInternal(true) Http Client, called close() Http Client, called closeInternal(true)  Exception in thread "main" javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure         at sun.security.ssl.Alerts.getSSLException(Unknown Source)         at sun.security.ssl.Alerts.getSSLException(Unknown Source)         at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)         at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)         at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)         at sun.security.ssl.SSLSocketImpl.writeRecord(Unknown Source)         at sun.security.ssl.AppOutputStream.write(Unknown Source)         at java.io.OutputStream.write(Unknown Source)         [...] 

回答1:

The site requires SNI (server name indication), that is without SNI the handshake will fail. All modern browsers support SNI, but not all SSL stacks in programming languages support SNI or use it by default. See http://www.vimino.com/2014/01/jep-114-tls-sni-extension-sunjsse-behavior-changes/ for how to use SNI with Java 8.

You can check for this kind of behavior with openssl s_client:

# without SNI $ openssl s_client -connect www.flixbus.de:443 CONNECTED(00000003) 140612985652896:error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure:s23_clnt.c:770: .... New, (NONE), Cipher is (NONE)  # with SNI $ openssl s_client -connect www.flixbus.de:443  -servername 'www.flixbus.de' CONNECTED(00000003) ... New, TLSv1/SSLv3, Cipher is ECDHE-RSA-AES128-GCM-SHA256 

Or you could use analyze.pl:

$ perl analyze-ssl.pl  www.flixbus.de -- www.flixbus.de port 443  * maximum SSL version  : TLSv1_2 (SSLv23)  ...  * SNI supported        : SSL upgrade fails without SNI 


回答2:

This error maybe the server not support Tls1.2 that you use



标签
易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!