问题：

Java，通过SSL连接时出错（握手时远程主机关闭连接）

斜瑞

2023-03-14

每个人我需要使用服务器和客户端证书连接到服务器。我正在使用以下代码：（移植形式的android）

private HttpsURLConnection getHttpsURLConnection(URL url, String certAlias)
        throws CertificateException, IOException, KeyStoreException, NoSuchAlgorithmException, KeyManagementException, UnrecoverableKeyException, java.security.cert.CertificateException {
    HttpsURLConnection connection = null;
    CertificateFactory certFactory = null;
    java.security.cert.Certificate cert = null;
    KeyStore keyStore = null;
    TrustManagerFactory tmFactory = null;
    SSLContext sslContext = null;

    //load client cert
    final KeyStore clientKS = getClientKeyStore();
    KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
    kmf.init(keyStore, clientCertificatePassword.toCharArray());

    // Load certificates from an InputStream
    certFactory = CertificateFactory.getInstance("X.509");

    InputStream servCertIS = new FileInputStream(caCertificateName);
    cert = certFactory.generateCertificate(servCertIS);

    // Create a KeyStore containing the trusted certificates
    keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
    keyStore.load(null, null);
    keyStore.setCertificateEntry(certAlias, cert);

    // Create a TrustManager that trusts the certificates in our KeyStore
    tmFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmFactory.init(keyStore);
    // Create an SSLContext that uses our TrustManager
    sslContext = SSLContext.getInstance("TLS");

    sslContext.init(kmf.getKeyManagers(), tmFactory.getTrustManagers(), null);

    connection = (HttpsURLConnection)url.openConnection();
    connection.setSSLSocketFactory(sslContext.getSocketFactory());
    InputStream in = connection.getInputStream(); //error!
    //peoccess inputStream here.

    return connection;

我已为ssl和握手启用调试属性，并获得以下输出：

*** ServerHelloDone
*** Certificate chain
***
*** ClientKeyExchange, RSA PreMasterSecret, TLSv1
main, WRITE: TLSv1 Handshake, length = 269
SESSION KEYGEN:
PreMaster Secret:
CONNECTION KEYGEN:
Client Nonce:
Server Nonce:
Master Secret:
Client MAC write Secret:
Server MAC write Secret:
Client write key:
Server write key:
Client write IV:
Server write IV:

main, WRITE: TLSv1 Change Cipher Spec, length = 1
*** Finished
verify_data:  { 104, 160, 185, 140, 237, 61, 94, 119, 119, 68, 101, 52 }
***
main, WRITE: TLSv1 Handshake, length = 48
main, received EOFException: error
main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
%% Invalidated:  [Session-1, TLS_RSA_WITH_AES_128_CBC_SHA]
main, SEND TLSv1 ALERT:  fatal, description = handshake_failure
main, WRITE: TLSv1 Alert, length = 32
main, called closeSocket()
javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
    at testClient1.getHttpsURLConnection(testClient1.java:86)
    at testClient1.getClient(testClient1.java:106)
    at testClient1.main(testClient1.java:134)
Caused by: java.io.EOFException: SSL peer shut down incorrectly
    at sun.security.ssl.InputRecord.read(Unknown Source)
    ... 11 more

我得到这个错误在Android设备和桌面java。但是我可以使用这个客户端证书自由地用网络浏览器连接到服务器。

也许这是重要的或不Url的服务器是：https://icon.sbrf.ru:9443（注意端口）也客户端证书是与西里尔名称（我不知道是这件事，但西里尔符号经常有麻烦）。

更新

这是认证请求

    *** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Cert Authorities:
<CN=ICONDP, OU=00CA, O=Savings Bank of the Russian Federation, L=RU, ST=Moscow>
<CN=SberBank External CA, O=sberbank, C=ru>
<CN=icon.sbrf.ru, OU=00CA, O=Savings Bank of the Russian Federation, C=RU>
<CN=Sberbank Enterprise CA, O=Sberbank, C=RU>
<CN=tv-icon01.sigma.sbrf.ru, OU=00CA, O=Savings Bank of the Russian Federation, C=RU>
<CN=TV-ICON01.sigma.sbrf.ru, OU=Root Certificate, OU=TV-ICON01Cell01, OU=TV-ICON01CellManager01, O=IBM, C=US>
<CN=Sberbank Root CA, O=Sberbank, C=RU>
<CN=Sberbank Test CA, O=Sberbank, C=RU>
*** ServerHelloDone
*** Certificate chain
***
*** ClientKeyExchange, RSA PreMasterSecret, TLSv1
main, WRITE: TLSv1 Handshake, length = 269
SESSION KEYGEN:
PreMaster Secret:
0000: 03 01 AC CE 4B 71 A4 A6   45 94 75 D8 B5 80 AE DA  ....Kq..E.u.....
0010: D3 01 0D 6F FA 1F 6F E4   F8 4C 47 7A EE 48 A6 02  ...o..o..LGz.H..
0020: 21 9F 79 6E 61 AE B0 DA   29 F0 97 B4 FD 0A 41 88  !.yna...).....A.
CONNECTION KEYGEN:
Client Nonce:
0000: 53 D6 17 36 80 81 C3 3B   16 E5 60 3E 29 B3 86 68  S..6...;..`>)..h
0010: F2 CA 49 13 87 19 98 A0   0C 88 88 FE 03 95 F6 91  ..I.............
Server Nonce:
0000: 53 D6 17 31 BA B0 DB E0   0A E2 7E 07 CF 04 C9 F9  S..1............
0010: 17 EA F1 F6 A5 C3 20 50   8D 3C 72 8F 42 57 DF 51  ...... P.<r.BW.Q
Master Secret:
0000: 92 49 CF 65 F3 64 26 CF   54 5F 78 2F 83 4E D2 4A  .I.e.d&.T_x/.N.J
0010: 20 E0 E0 AE CC 5F F8 6B   09 4E 2F E6 A8 01 94 10   ...._.k.N/.....
0020: 35 7B BD 2B A7 43 2E D2   4C 0F B1 F6 3C 6B 1E 08  5..+.C..L...<k..
Client MAC write Secret:
0000: 87 04 6A 37 DD 7F B6 D6   AA 31 FE 10 C8 0E B0 71  ..j7.....1.....q
0010: 16 6F 72 AF                                        .or.
Server MAC write Secret:
0000: C7 64 75 F7 E2 67 2C 8F   DF 14 6C 5E 7E 01 8A C1  .du..g,...l^....
0010: A0 8B E4 C4                                        ....
Client write key:
0000: 3E CE F3 FC B1 B0 C7 E2   6C F1 20 68 36 39 A5 E5  >.......l. h69..
Server write key:
0000: 26 C8 9F 98 DE 58 D3 0E   A1 25 38 05 4E E7 25 DF  &....X...%8.N.%.
Client write IV:
0000: 0C CE 33 F3 1C 00 C1 5B   3F 75 F7 EF EB AA 16 69  ..3....[?u.....i
Server write IV:
0000: 1A 18 D6 B1 32 23 5D 26   24 26 96 BC 42 1F 27 A2  ....2#]&$&..B.'.
main, WRITE: TLSv1 Change Cipher Spec, length = 1
*** Finished
verify_data:  { 228, 62, 93, 239, 222, 236, 155, 56, 146, 50, 189, 117 }
***
main, WRITE: TLSv1 Handshake, length = 48
main, received EOFException: error
main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
%% Invalidated:  [Session-1, TLS_RSA_WITH_AES_128_CBC_SHA]
main, SEND TLSv1 ALERT:  fatal, description = handshake_failure
main, WRITE: TLSv1 Alert, length = 32
main, called closeSocket()

证书链实际上是空的，我不知道为什么，因为我使用的是100%的工作客户端证书（我通过webbrowser进行了检查）。

还有很多其他的信息，包括这个记录之前日志文件中的证书链，但是我相信它们都是关于服务器证书的。

因此，似乎问题是在证书加载代码的某个地方，但我不知道在哪里

更新2

因此，我创建了一个kesytore并在那里导入客户端证书，将其转换为jks。下面是keytool-list-keystore测试的结果。jks-v

Keystore type: JKS
Keystore provider: SUN

Your keystore contains 2 entries

Alias name: lp-32205b37-88a0-4d85-8c6a-4a18daa82dd0
Creation date: 28.07.2014
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: EMAILADDRESS=RONovoselov.SBT@sberbank.ru, CN=Новоселов Роман Олегович, OU=CA_Users, OU=CA, DC=sigma, DC=sbrf, DC=ru
Issuer: CN=SberBank External CA, O=sberbank, C=ru
Serial number: 4ccbdc23000000002851
Valid from: Wed Mar 07 16:55:00 MSK 2012 until: Fri Mar 07 17:05:00 MSK 2014
Certificate fingerprints:
     MD5:  A0:6F:EA:C6:16:34:8D:46:67:26:21:E0:C6:28:BC:63
     SHA1: 19:77:D8:62:44:49:08:89:0E:42:60:8E:64:D2:97:18:36:B5:BA:2D
     SHA256: D0:CF:86:FD:46:0F:29:E7:4A:26:AE:D5:63:5B:C8:41:1E:A8:D3:13:9E:EC:0D:BA:C6:8D:B1:D4:4D:21:2B:45
     Signature algorithm name: SHA1withRSA
     Version: 3

Extensions: 

#1: ObjectId: 1.2.840.113549.1.9.15 Criticality=false
0000: 30 35 30 0E 06 08 2A 86   48 86 F7 0D 03 02 02 02  050...*.H.......
0010: 00 80 30 0E 06 08 2A 86   48 86 F7 0D 03 04 02 02  ..0...*.H.......
0020: 00 80 30 07 06 05 2B 0E   03 02 07 30 0A 06 08 2A  ..0...+....0...*
0030: 86 48 86 F7 0D 03 07                               .H.....


#2: ObjectId: 1.3.6.1.4.1.311.21.10 Criticality=false
0000: 30 18 30 0A 06 08 2B 06   01 05 05 07 03 04 30 0A  0.0...+.......0.
0010: 06 08 2B 06 01 05 05 07   03 02                    ..+.......


#3: ObjectId: 1.3.6.1.4.1.311.21.7 Criticality=false
0000: 30 2F 06 27 2B 06 01 04   01 82 37 15 08 84 F3 D1  0/.'+.....7.....
0010: 3C 87 F2 87 61 87 BD 9B   02 83 AA B4 63 81 82 FA  <...a.......c...
0020: 35 81 2A 84 FB D4 1C 83   BD CB 49 02 01 64 02 01  5.*.......I..d..
0030: 17                                                 .


#4: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://pki.sberbank.ru/pki/aia/Cert01.sigma.sbrf.ru_SberBank%20External%20CA.crt
, 
   accessMethod: caIssuers
   accessLocation: URIName: ldap:///CN=SberBank%20External%20CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=sigma,DC=sbrf,DC=ru?cACertificate?base?objectClass=certificationAuthority
, 
   accessMethod: ocsp
   accessLocation: URIName: http://extpki.sigma.sbrf.ru/CertEnroll/Cert01.sigma.sbrf.ru_SberBank%20External%20CA.crt
]
]

#5: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: DB F3 38 88 08 D3 25 A2   D6 3E 5A C2 28 6D 21 09  ..8...%..>Z.(m!.
0010: E7 2E 1E B3                                        ....
]
]

#6: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://pki.sberbank.ru/pki/cdp/SberBank%20External%20CA.crl, URIName: ldap:///CN=SberBank%20External%20CA,CN=Cert01,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=sigma,DC=sbrf,DC=ru?certificateRevocationList?base?objectClass=cRLDistributionPoint, URIName: http://extpki.sigma.sbrf.ru/CertEnroll/SberBank%20External%20CA.crl]
]]

#7: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  emailProtection
  clientAuth
]

#8: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

#9: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  Other-Name: Unrecognized ObjectIdentifier: 1.3.6.1.4.1.311.20.2.3
  RFC822Name: RONovoselov.SBT@sberbank.ru
]

#10: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 4C AB B5 F4 9B 7D FB 50   73 E0 CF EB AC 3D 00 5F  L......Ps....=._
0010: FE 82 32 9F                                        ..2.
]
]



*******************************************
*******************************************


Alias name: test
Creation date: 28.07.2014
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=Aleksey Makarkin, OU=SBRF, O=SBRF, L=Moscow, ST=Moscow, C=RU
Issuer: CN=Aleksey Makarkin, OU=SBRF, O=SBRF, L=Moscow, ST=Moscow, C=RU
Serial number: 7f98a299
Valid from: Mon Jul 28 15:10:33 MSK 2014 until: Sun Oct 26 15:10:33 MSK 2014
Certificate fingerprints:
     MD5:  BC:51:FA:3B:6A:EB:4A:40:BC:87:53:DB:6D:E5:D7:59
     SHA1: 74:6B:08:92:0C:8D:57:34:CF:18:EC:6D:60:70:07:C2:07:E5:C5:00
     SHA256: DD:4D:C7:3E:0C:4F:25:1B:6F:07:76:98:C2:B4:C8:5D:C9:A8:9D:87:E5:8D:AE:12:26:8C:22:0C:89:1D:E3:02
     Signature algorithm name: SHA1withDSA
     Version: 3

Extensions: 

#1: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 06 F5 F7 A7 83 44 FC 9C   F2 70 6B EC 04 E8 03 3E  .....D...pk....>
0010: C4 B5 A0 FC                                        ....
]
]



*******************************************
*******************************************

共有2个答案

井学

2023-03-14

最后我解决了这个问题。

一开始我有个愚蠢的错别字

final KeyStore clientKS = getClientKeyStore(); //save client certificate in one keyStore
...
kmf.init(keyStore, clientCertificatePassword.toCharArray()); //load into another( use if for server certificate lately)

其次，我正在使用的证书似乎已被弃用

Valid from: Wed Mar 07 16:55:00 MSK 2012 until: Fri Mar 07 17:05:00 MSK 2014

出于某种原因，Chrome web浏览器忽略了这一点，但JVM（？）-不我不知道这怎么可能，但这是观察到的行为。

感谢@EJP的支持

轩辕成天

2023-03-14

服务器请求客户端证书，而您没有发送，因此它关闭了连接。

要么根本没有客户端证书，要么至少没有服务器信任的客户端证书。在跟踪开始之前，您可以在CertificateRequest消息中看到服务器信任的签名者。

Java，通过SSL连接时出错（握手时远程主机关闭连接）

共有2个答案

相关问答

相关文章

相关阅读

相关工具

相关文档