首页 / JAVA / javax.net.ssl.SSLHandshakeException：收到致命警报：handshake_failure

javax.net.ssl.SSLHandshakeException：收到致命警报：handshake_failure

内容导读

互联网集市收集整理的这篇技术教程文章主要介绍了javax.net.ssl.SSLHandshakeException：收到致命警报：handshake_failure，小编现在分享给大家，供广大互联网技能从业者学习和参考。文章包含8910字，纯文字阅读大概需要13分钟。

内容图文

我在具有Java 1.7.0_67的Linux服务器上使用APR 1.1.33和Tomcat 7.065.

多年来,我的应用程序一直很高兴通过SSL连接到第三方站点.第三方签发了新证书.第三部分站点是：
https://its.changehealthcare.com/

我下载了.cer文件并进行了keytool导入：

$JAVA_HOME/bin/keytool -import -trustcacerts -keystore cacerts  -noprompt -file path\to\certificate.cer

当我做一个keytool列表时,我得到：

Owner: CN=its.changehealthcare.com, OU=COMODO EV SSL, OU=Web Operations, O=Change Healthcare Inc, STREET=3055 Lebanon Pike, L=Nashville, ST=TN, OID.2.5.4.17=37221, C=US, OID.2.5.4.15=Private Organization, OID.1.3.6.1.4.1.311.60.2.1.2=Delaware, OID.1.3.6.1.4.1.311.60.2.1.3=US, SERIALNUMBER=4237148
  DNSName: its.changehealthcare.com
  DNSName: www.its.changehealthcare.com

但我仍然收到ssl握手错误.

我的tomcat ssl配置看起来像这样：

<Connector protocol="org.apache.coyote.http11.Http11AprProtocol"
           port="8443" minSpareThreads="5" maxSpareThreads="75"
           enableLookups="true" disableUploadTimeout="true"
           acceptCount="100"  maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           clientAuth="false"
SSLProtocol="TLSv1+TLSv1.1+TLSv1.2"
        SSLCertificateFile="mycert.crt"
        SSLCertificateKeyFile="mykey.key"
        SSLCertificateChainFile="gd_bundle-g2-g1.crt"
        keyAlias="tomcat"
        SSLCipherSuite="ALL:!ADH:!RC4:+HIGH:+MEDIUM:!LOW:!SSLv2:!EXPORT:!DHE:!EDH:!ECDH"
           compression="on" compressableMimeType="text/xml"
SSLHonorCipherOrder="true"
/>

我很困惑.任何见解表示赞赏.
这是在-Djavax.net.debug = all上调试时完整读取的错误：

INFO: Server startup in 26519 ms
keyStore is :
keyStore type is : jks
keyStore provider is :
init keystore
init keymanager of type SunX509
trustStore is: /usr/lib/java/jdk1.7.0_67/jre/lib/security/cacerts
trustStore type is : jks
trustStore provider is :
init truststore


adding as trusted cert:
  Subject: CN=SwissSign Platinum CA - G2, O=SwissSign AG, C=CH
  Issuer:  CN=SwissSign Platinum CA - G2, O=SwissSign AG, C=CH
  Algorithm: RSA; Serial number: 0x4eb200670c035d4f
  Valid from Wed Oct 25 03:36:00 CDT 2006 until Sat Oct 25 03:36:00 CDT 2036

******THERE ARE LIKE 20 of these but I could fit it inside the character limit so just the first and last are shown
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
adding as trusted cert:
****THERE ARE LIKE 30 of these but I could fit it inside the character limit so just the first and last are shown**

adding as trusted cert:
  Subject: CN=TC TrustCenter Class 2 CA II, OU=TC TrustCenter Class 2 CA, O=TC TrustCenter GmbH, C=DE
  Issuer:  CN=TC TrustCenter Class 2 CA II, OU=TC TrustCenter Class 2 CA, O=TC TrustCenter GmbH, C=DE
  Algorithm: RSA; Serial number: 0x2e6a000100021fd752212c115c3b
  Valid from Thu Jan 12 08:38:43 CST 2006 until Wed Dec 31 16:59:59 CST 2025

trigger seeding of SecureRandom
done seeding SecureRandom
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
http-apr-8443-exec-1, setSoTimeout(25000) called
%% No cached client session
*** ClientHello, TLSv1
RandomCookie:  GMT: 1458500800 bytes = { 168, 201, 205, 79, 149, 19, 79, 199, 46, 252, 11, 245, 12, 118, 202, 82, 232, 228, 105, 152, 123, 244, 31, 152, 229, 163, 180, 208 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension server_name, server_name: [host_name: its.changehealthcare.com]
***
[write] MD5 and SHA1 hashes:  len = 196
0000: 01 00 00 C0 03 01 57 EF   F5 C0 A8 C9 CD 4F 95 13  ......W......O..
0010: 4F C7 2E FC 0B F5 0C 76   CA 52 E8 E4 69 98 7B F4  O......v.R..i...
0020: 1F 98 E5 A3 B4 D0 00 00   38 C0 0A C0 14 00 35 C0  ........8.....5.
0030: 05 C0 0F 00 39 00 38 C0   09 C0 13 00 2F C0 04 C0  ....9.8...../...
0040: 0E 00 33 00 32 C0 07 C0   11 00 05 C0 02 C0 0C C0  ..3.2...........
0050: 08 C0 12 00 0A C0 03 C0   0D 00 16 00 13 00 04 00  ................
0060: FF 01 00 00 5F 00 0A 00   34 00 32 00 17 00 01 00  ...._...4.2.....
0070: 03 00 13 00 15 00 06 00   07 00 09 00 0A 00 18 00  ................
0080: 0B 00 0C 00 19 00 0D 00   0E 00 0F 00 10 00 11 00  ................
0090: 02 00 12 00 04 00 05 00   14 00 08 00 16 00 0B 00  ................
00A0: 02 01 00 00 00 00 1D 00   1B 00 00 18 69 74 73 2E  ............its.
00B0: 63 68 61 6E 67 65 68 65   61 6C 74 68 63 61 72 65  changehealthcare
00C0: 2E 63 6F 6D                                        .com
http-apr-8443-exec-1, WRITE: TLSv1 Handshake, length = 196
[Raw write]: length = 201
0000: 16 03 01 00 C4 01 00 00   C0 03 01 57 EF F5 C0 A8  ...........W....
0010: C9 CD 4F 95 13 4F C7 2E   FC 0B F5 0C 76 CA 52 E8  ..O..O......v.R.
0020: E4 69 98 7B F4 1F 98 E5   A3 B4 D0 00 00 38 C0 0A  .i...........8..
0030: C0 14 00 35 C0 05 C0 0F   00 39 00 38 C0 09 C0 13  ...5.....9.8....
0040: 00 2F C0 04 C0 0E 00 33   00 32 C0 07 C0 11 00 05  ./.....3.2......
0050: C0 02 C0 0C C0 08 C0 12   00 0A C0 03 C0 0D 00 16  ................
0060: 00 13 00 04 00 FF 01 00   00 5F 00 0A 00 34 00 32  ........._...4.2
0070: 00 17 00 01 00 03 00 13   00 15 00 06 00 07 00 09  ................
0080: 00 0A 00 18 00 0B 00 0C   00 19 00 0D 00 0E 00 0F  ................
0090: 00 10 00 11 00 02 00 12   00 04 00 05 00 14 00 08  ................
00A0: 00 16 00 0B 00 02 01 00   00 00 00 1D 00 1B 00 00  ................
00B0: 18 69 74 73 2E 63 68 61   6E 67 65 68 65 61 6C 74  .its.changehealt
00C0: 68 63 61 72 65 2E 63 6F   6D                       hcare.com
[Raw read]: length = 5
0000: 15 03 01 00 02                                     .....
[Raw read]: length = 2
0000: 02 28                                              .(
http-apr-8443-exec-1, READ: TLSv1 Alert, length = 2
http-apr-8443-exec-1, RECV TLSv1 ALERT:  fatal, handshake_failure
http-apr-8443-exec-1, called closeSocket()
http-apr-8443-exec-1, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
http-apr-8443-exec-1, called close()
http-apr-8443-exec-1, called closeInternal(true)

解决方法:

I downloaded the .cer file and did a keytool import … But I continue to get an ssl handshake error.

来自服务器的握手错误与客户端对服务器证书的验证无关.因此,信任新证书无助于此错误.

*** ClientHello, TLSv1

尽管服务器只能根据SSLLabs执行TLS 1.2,但您的客户端仅发送TLS 1.0请求.

在这种情况下,为您的tomcat服务器配置TLS 1.2并不重要,因为问题是您的TLS客户端无法连接到第三方服务器.请参阅示例Enabled TLS 1.2 and TLS 1.1 on Java 7,以了解如何在客户端上配置Java 7以使用TLS 1.2.

内容总结

以上是互联网集市为您收集整理的javax.net.ssl.SSLHandshakeException：收到致命警报：handshake_failure全部内容，希望文章能够帮你解决javax.net.ssl.SSLHandshakeException：收到致命警报：handshake_failure所遇到的程序开发问题。 如果觉得互联网集市技术教程内容还不错，欢迎将互联网集市网站推荐给程序员好友。

内容备注

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 gblab@vip.qq.com 举报，一经查实，本站将立刻删除。

内容手机端

扫描二维码推送至手机访问。

本文链接：https://qyyshop.com/info/683285.html

来源：【匿名】