使用Apache Httpclient和WebSphere Liberty配置文件设置TLS版本

Question

我们正在从WebSphere Liberty Profile（8.5.5.6）REST服务访问一个外部服务，该服务使用Apache HTTPClient 4.3.5连接到该服务。

该服务刚刚更改为使用TLS v1。现在我们的服务失败了：[4/21/16 12:23:37:596 EDT]000000 5D bm。myw3。服务。awf。sso。ejb。发电机SSOTokeneratorImpl I异常：：javax。网ssl。SSLException:收到致命警报：协议_版本[4/21/16 12:23:37:597 EDT]000000 5D com。国际商用机器公司myw3。服务。awf。sso。ejb。SSOTokenManagerBean E SSOTokenGeneratorException:：{0}com。国际商用机器公司myw3。服务。awf。sso。ejb。配置。SSOTokeneratorException：执行http请求以检索令牌时发生异常

我们找到了以下链接，并在代码中实现了它：
如何在apache HttpClient上设置TLS版本

SSLContext sslContext = SSLContexts.custom().useTLS().build();
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new String[] { "TLSv1.2" }, null, SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

我还设置了“https”。协议'：

wasadmin 28548 1 10 12:28 pts/0 00:00:55/usr/lib/jvm/jre-1.7.1-ibm。x86_64/bin/java-javaagent:/opt/IBM/WebSphere/Liberty/wlp/bin/tools/ws-javaagent。贾尔贾瓦。awt。headless=true-XX:MaxPermSize=256m-Dcom。国际商用机器公司html" target="_blank">安全辖区policydir=/devops/w3Services/ssoProxy-Dhttps。协议=TLSv1。2、TLSv1。TLSv1-jar/opt/IBM/WebSphere/Liberty/wlp/bin/tools/ws-server。jar w3svcs-ssoproxy-svr1

但这没什么区别。我们还需要做些什么才能让它与WLP一起工作吗？

Answer 1

构建HttpClient实例时，不能同时设置自定义套接字工厂和完全初始化的连接管理器。方法#setConnectionManager取代#setSSLSocketFactory。

要么这样做

SSLContext sslContext = SSLContexts.custom().useProtocol("TLSv1.2").build();
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new String[] { "TLSv1.2" },
        new String[] { "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
        SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
HttpClientBuilder httpClientBuilder = HttpClientBuilder.create()
        .setDefaultRequestConfig(requestConfig)
        .setSSLSocketFactory(sslsf);

还是这个

SSLContext sslContext = SSLContexts.custom().useProtocol("TLSv1.2").build();
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new String[] { "TLSv1.2" },
        new String[] { "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
        SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);

Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create()
        .register("http", PlainConnectionSocketFactory.getSocketFactory())
        .register("https", sslsf)
        .build();
PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(socketFactoryRegistry);

HttpClientBuilder httpClientBuilder = HttpClientBuilder.create()
        .setDefaultRequestConfig(requestConfig)
        .setConnectionManager(cm);

哦，是的，还有一件事。请考虑升级到4.5

Answer 2

我们尝试了其他一些方法，下面是我们最新的代码迭代：

SSLContext sslContext = SSLContexts.custom().useProtocol("TLSv1.2").build();
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new String[] { "TLSv1.2" },
    new String[] { "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" },
    SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
HttpClientBuilder httpClientBuilder = HttpClientBuilder.create().setDefaultRequestConfig(requestConfig)
    .setConnectionManager(connManager).setSSLSocketFactory(sslsf);
handleAuthentication(uri, httpClientBuilder);
httpClient = httpClientBuilder.build();

我还设置了以下JVM选项：
JVM_ARGS=-Dhttps。协议=TLSv1。2-Djdk。tls。客户协议=TLSv1。2-Djavax。网调试=全部

但是我们仍然得到错误：

[4/21/16 17:27:37:123 EDT]00000042 id=bm。myw3。服务。awf。sso。ejb。发电机SSOTokeneratorImpl I异常：：javax。网ssl。SSLException:收到致命警报：协议版本[4/21/16 17:27:37:124 EDT]000000 42 id=com。国际商用机器公司myw3。服务。awf。sso。ejb。SSOTokenManagerBean E SSOTokenGeneratorException:：{0}com。国际商用机器公司myw3。服务。awf。sso。ejb。配置。SSOTokeneratorException：执行http请求以检索令牌时发生异常

我有线索。来自WLP的日志，如果有人认为可以查看，我可以上传。但这里有各种追踪记录：

Default Executor-thread-25, WRITE: TLSv1.2 Handshake, length = 80
Default Executor-thread-25, WRITE: TLSv1.2 Application Data, length = 256
Default Executor-thread-25, READ: TLSv1.2 Application Data, length = 1552
SEND TLSv1.2 ALERT:
Finalizer thread, WRITE: TLSv1.2 Alert, length = 64

然后它继续尝试TLSv1，我们正在调用的服务不再支持它。我不确定要寻找什么来确定它为什么不使用TLSv1。但是没有任何东西从痕迹中向我跳出来。