java https 请求 javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure-阿里云开发者社区

开发者社区> 安全> 正文

java https 请求 javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

简介: java https 请求 javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

最近联调https接口时,请求https 一直报handshake_failure 握手失败。在网上百度了几天,验证了很多方法,一直没有解决我的问题。

我把我的解决方法,分析一下,供大家参考

http-nio-8084-exec-1, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

HTTPS 专用检测工具网站

https://myssl.com/

HTTPS 安全评估、ATS 检测、证书链补全工具、HTTP/2 支持检测

解决方法1:设置https.protocols

System.setProperty("https.protocols", "TLSv1.2,TLSv1.1,SSLv3");

设置输出网络日志

System.setProperty("javax.net.debug", "all");

然后看到下面的输出:

0000: 16 03 03 00 89 01 00 00 85 03 03 5F 6A C2 08 7C ..........._j...
0010: A9 2A 33 9A C9 B7 D2 11 CA A4 49 2F CD CB 74 14 .*3.......I/..t.
0020: 09 BB 6F 4B 0C 7A 81 82 62 D1 7A 00 00 26 00 3D ..oK.z..b.z..&.=
0030: 00 6B 00 6A 00 35 00 39 00 38 00 3C 00 67 00 40 .k.j.5.9.8.<.g.@
0040: 00 2F 00 33 00 32 00 9D 00 9F 00 A3 00 9C 00 9E ./.3.2..........
0050: 00 A2 00 FF 01 00 00 36 00 0D 00 1C 00 1A 06 03 .......6........
0060: 06 01 05 03 05 01 04 03 04 01 04 02 03 03 03 01 ................
0070: 03 02 02 03 02 01 02 02 00 00 00 12 00 10 00 00 ................
0080: 0D 61 70 69 2E 39 39 35 31 32 30 2E 63 6E .api.995120.cn

0000: 15 03 03 00 02 .....

0000: 02 28 .(
http-nio-8084-exec-1, READ: TLSv1.2 Alert, length = 2
http-nio-8084-exec-1, RECV TLSv1.2 ALERT: fatal, handshake_failure
http-nio-8084-exec-1, called closeSocket()
http-nio-8084-exec-1, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
at sun.net.www.protocol.http.HttpURLConnection$10.run(HttpURLConnection.java:1950)
at sun.net.www.protocol.http.HttpURLConnection$10.run(HttpURLConnection.java:1945)
at java.security.AccessController.doPrivileged(Native Method)
at sun.net.www.protocol.http.HttpURLConnection.getChainedException(HttpURLConnection.java:1944)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1514)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1498)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:268)
at com.hipee.web.hour24ecg.controller.TestController.saveBinary(TestController.java:39)
at com.hipee.web.hour24ecg.controller.TestController.versionInfo(TestController.java:25)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

解决方法2:替换JCE包
因为我的服务器是jdk8版本,下载后解压,可以看到local_policy.jar和US_export_policy.jar以及readme.txt,
替换${java_home}/jre/lib/security/ 下面的local_policy.jar和US_export_policy.jar即可
JDK7: https://www.jianshu.com/go-wild?ac=2&url=https%3A%2F%2Fwww.oracle.com%2Ftechnetwork%2Fjava%2Fjavase%2Fdownloads%2Fjce-7-download-432124.html
JDK8: https://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html
但我的jdk版本格式如上

[developer@143-196 security]$ pwd

/usr/java/jdk1.8.0_231/jre/lib/security
[developer@143-196 security]$ ll
total 160
-rw-r--r-- 1 10 143 4054 Oct 5 2019 blacklist
-rw-r--r-- 1 10 143 1273 Oct 5 2019 blacklisted.certs
-rw-r--r-- 1 10 143 100515 Oct 5 2019 cacerts
-rw-r--r-- 1 10 143 2466 Oct 5 2019 java.policy
-rw-r--r-- 1 10 143 44261 Oct 5 2019 java.security
-rw-r--r-- 1 10 143 98 Oct 5 2019 javaws.policy
drwxr-xr-x 4 10 143 38 Oct 5 2019 policy
-rw-r--r-- 1 10 143 0 Oct 5 2019 trusted.libraries
[developer@143-196 security]$ tree policy/
policy/
├── limited
│   ├── local_policy.jar
│   └── US_export_policy.jar
└── unlimited

├── local_policy.jar
└── US_export_policy.jar

因为从Java 1.8.0_151版本开始,java公司为JVM启用无限制强度管辖策略,则不能使用AES-256。把java.security文件的第826行的注释去掉即可

crypto.policy=unlimited

重新启动项目,还是失败
linux服务器错误日志:

keyStore is :

keyStore type is : jks
keyStore provider is :
init keystore
init keymanager of type SunX509
trigger seeding of SecureRandom
done seeding SecureRandom
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
http-nio-8084-exec-1, setSoTimeout(0) called
http-nio-8084-exec-1, the previous server name in SNI (type=host_name (0), value=api.995120.cn) was replaced with (type=host_name (0), value=api.995120.cn)
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
%% No cached client session

win本地环境正常日志

Allow unsafe renegotiation: true

Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
qtp1971495275-19, setSoTimeout(0) called
qtp1971495275-19, the previous server name in SNI (type=host_name (0), value=api.995120.cn) was replaced with (type=host_name (0), value=api.995120.cn)
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1

发现确实*SHA384

解决方法3:BouncyCastle配置
BouncyCastle是一款开源的密码包,其中包含了大量的密码算法,使用BouncyCastle的目的就是为了扩充算法支持
(1) 将bcprov-jdk15on-162.jar文件导入相关工程
(2) 在需要使用加密的代码中导入以下两个类

import java.security.Security;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

(3) 在初始化密钥工厂、密钥生成器等引擎前调用如下代码:
加入BouncyCastleProvider的支持

Security.add.addProvider(new BouncyCastleProviderrr());

或者使用以下方式

MessageDigest md = MessageDigest.getInstant("MD4","BC");

//每个提供者都有简称,Bouncy Castle提供者的简称为BC

    <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcprov-jdk15on</artifactId>
        <version>1.66</version>
    </dependency>
    <dependency>
        <groupId>org.bouncycastle</groupId>
        <artifactId>bcprov-ext-jdk15on</artifactId>
        <version>1.66</version>
    </dependency>

最终解决

版权声明:本文内容由阿里云实名注册用户自发贡献,版权归原作者所有,阿里云开发者社区不拥有其著作权,亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容,填写侵权投诉表单进行举报,一经查实,本社区将立刻删除涉嫌侵权内容。

分享:
+ 订阅

云安全开发者的大本营

其他文章