建立连接时出错：net:：ERR_SSL_VERSION_或_CIPHER_不匹配

Question

我已经按照Digicert在下面链接上提供的说明在服务器上安装了SSL/TLS证书。https://www.digicert.com/ssl-certificate-installation-java.htm

还定义了TrustManager，但仍然无法建立安全连接。我收到连接失败错误，原因是“连接建立错误：net:：ERR_SSL_VERSION_或_CIPHER_不匹配”

下面是我添加SSL支持的代码。

private static void addSSLSupport(DefaultIoFilterChainBuilder chain)
        throws Exception {
    try {
        KeyStore keyStore=KeyStore.getInstance("JKS");
        char[] passphrase= {'t','e','s','t','s','s','l'};
        keyStore.load(new FileInputStream("/home/ec2-user/digicert/mydomain.jks"),passphrase);
        Util.logInfo("Key Store loaded");
        SSLContext ctx=SSLContext.getInstance("TLS");
        TrustManagerFactory trustFactory=TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        trustFactory.init(keyStore);
        X509TrustManager defaultTrustManager = (X509TrustManager) trustFactory.getTrustManagers()[0];
        ctx.init(null, trustFactory.getTrustManagers(), null);            
        SslFilter sslFilter = new SslFilter(ctx);
        chain.addLast("sslFilter", sslFilter);
        Util.logInfo("SSL ON");
    }catch(Exception e){
        Util.logError(e.toString());
        throw e;
    }
}

Answer 1

在初始化SSLContext时，我使用KeyManager而不是TrustManager实现了这一点。下面是代码供您参考。

private static void addSSLSupport(DefaultIoFilterChainBuilder chain)
        throws Exception {
    try {
        KeyStore keyStore=KeyStore.getInstance("JKS");
        char[] passphrase= {'t','e','s','t','s','s','l'};
        keyStore.load(new FileInputStream("/root/mydomain.jks"),passphrase);
        Util.logInfo("Key Store loaded");
        KeyManagerFactory kmf = KeyManagerFactory
             .getInstance(KEY_MANAGER_FACTORY_ALGORITHM);
        kmf.init(keyStore, passphrase);
        SSLContext ctx=SSLContext.getInstance("TLS");
        ctx.init(kmf.getKeyManagers(), null, null);            
        SslFilter sslFilter = new SslFilter(ctx);
        chain.addLast("sslFilter", sslFilter);
        Util.logInfo("SSL ON");
    }catch(Exception e){
        Util.logError(e.toString());
        throw e;
    }
}