☰

基于 Java 7 的服务器上的 SSL 连接失败，并出现 RECV TLSv1 ALERT：致命、handshake_failure

tag-icon • tag-icon java ssl tls
基于 Java 7 的服务器上的 SSL 连接失败，并出现 RECV TLSv1 ALERT：致命、handshake_failure

基于 Java 7 的服务器上的客户端 SSL 连接失败，并显示 RECV TLSv1 ALERT：致命，handshake_failure。此客户端正在尝试连接到https://www.iatspayments.com

SSL 调试日志显示以下内容：

Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
%% No cached client session
*** ClientHello, TLSv1
RandomCookie:  GMT: 1438043029 bytes = { 77, 33, 40, 115, 168, 242, 145, 193, 121, 154, 125, 158, 66, 181, 49, 10, 251, 113, 134, 200, 45, 171, 200, 108, 155, 99, 67, 176 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension server_name, server_name: [host_name: www.iatspayments.com]
***
jrpp-1, WRITE: TLSv1 Handshake, length = 192
jrpp-1, READ: TLSv1 Alert, length = 2
jrpp-1, RECV TLSv1 ALERT:  fatal, handshake_failure
jrpp-1, called closeSocket()
jrpp-1, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
jrpp-1, IOException in getSession():  javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

我已经升级了加密强度Java 加密扩展 (JCE) 无限强度管辖策略文件 7 下载

根据Qualsys SSL 测试，服务器仅接受TLS1.1和TLS1.2协议。

我为 JVM 提供了以下启动属性：

-Dhttps.protocols=TLSv1.2,TLSv1.1 -Ddeployment.security.SSLv2Hello=false -Ddeployment.security.SSLv3=false -Ddeployment.security.TLSv1=false -Ddeployment.security.TLSv1.1=true -Ddeployment.security.TLSv1.2=true

从调试日志中可以看出，客户端正在使用 TLSv1 进行握手和数据会话，然后失败。

两个问题：

  1. 我已禁用 TLSv1 协议作为受支持的协议，为什么客户端仍使用 TLSv1 协议启动？

  2. 我可以进行哪些系统设置以使服务器在建立 SSL 连接时使用 TLSv1.1+？

注意我已经审核过了为 Java 7 上的客户端启用 TLS 1.1 和 1.2并且我已经实现了这些设置。

答案1

这最终对我有用：

SSLContext context = SSLContext.getInstance("TLSv1.2");
context.init(null,null,null);
SSLContext.setDefault(context);

答案2

Java 7 比较旧，没有内置许多较新和/或更强大的密码。

对我来说，解决方案是安装Java 加密扩展 (JCE) 无限强度管辖策略文件 7

相关内容