Not able to connect to server through java code. Getting javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

Question

I am trying to build a Test Automation Tool for REST API on AWS using rest-assured framework. I just tried with a simple HTTP POST and checking the output J

Answer 1

I am new to rest-assured, but the java SSL problems like handshake_failure are usually the same:

• Incompatible cipher suites: The client has to use a cipher suite enabled by the server
• Incompatible versions of SSL/TLS: The client have to ensure that it uses a compatible version. For example the server might force TLS1.2 that is not enabled by default in java7
• Incomplete trust path for the server certificate: the server certificate is probably not trusted by the client. Usually the fix is to import the server certificate chain in into the client trust store.
• Bad server config, like certificate issued to a different domain or certificate chain incomplete. In the case the fix is on server part

To detect the cause the following environment variable can be set to verbose the protocol details

-Djavax.net.debug=ssl

For your specific issue with SSL, take a look at rest assured ssl documentation https://github.com/rest-assured/rest-assured/wiki/Usage#ssl

First you can try to disable usual https verification

given().relaxedHTTPSValidation().when().get("https://some_server.com"). .. 

If it works, create a JKS truststore with the certificates of the server

1)Download them from the server (click on browser green lock and download each one) 2) Create the JKS with keytool and import the trusted certificates. Follow the guide in rest-assured guide or use portecle 3) Configure truststore in JKS

given().keystore("/pathToJksInClassPath", <password>). .. 

If you need client authentication ( I think no), check this post How to make HTTPS GET call with certificate in Rest-Assured java

If nothing of this works for you, do not forget todebug the SSL connection with

 -Djavax.net.debug=ssl

Ensure that the algorithm of your server is supported by your client. For example if you use Java7, TLS1.2 is not enabled by default

Answer 2

Try overriding the apache HTTP Client version--upgrading it to 4.5.3 in my pom.xml file fixed it for me.

Answer 3

Two possible explanations:

• Your local java security not able to trust the target. Import target public cert as trusted entry.

• SSL version of target could be different from default outboud SSL version your JVM is choosing.

Answer 4

You may need to install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files 8 from here