RestTemplate GET请求中的handshake_failure在浏览器中工作

Question

org.springframework.web.client.ResourceAccessException: I/O error on GET request for "https://...": Received fatal alert: handshake_failure; nested exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:673)
    at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:635)
    at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:556)

UriBuilder uriBuilder = UriBuilder.fromUri(URLDecoder.decode(URL, "UTF-8"));
HttpHeaders headers = new HttpHeaders();
headers.add("Accept", "text/html,application/xhtml+xml,application/xml");
headers.add(HttpHeaders.USER_AGENT, "Mozilla...");
HttpEntity<?> entity = new HttpEntity<Object>(headers);
ResponseEntity<ResponseVO> response = restTemplate.exchange(uriBuilder.build(), 
       HttpMethod.GET, entity, ResponseVO.class);

null

SSL connection using TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

也尝试了配置跳过SSL证书验证,输出相同：

TrustStrategy acceptingTrustStrategy=(X509Certificate[]chain,String authType)->

SSLContext SSLContext=org.apache.http.ssl.SSLContexts.custom（）.LoadTrustMaterial（null,acceptingTrustStrategy）.build（）；

*       subject: CN=*.site.com,OU=Domain Control Validated
*       start date: May 24 08:13:23 2019 GMT
*       expire date: May 24 08:13:23 2021 GMT
*       common name: *.site.com
*       issuer: CN=Go Daddy Secure Certificate Authority - G2,OU=http://certs.godaddy.com/repository/,O="GoDaddy.com, Inc.",L=Scottsdale,ST=Arizona,C=US

sudo keytool -importcert -file filename.cer -alias randomaliasname -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit 

我使用的是Java8更新151。

尝试从@RMunge answer中添加BouncyCastleProvider的解决方案，但仍然错误

security.provider.6=org.bouncycastle.jce.provider.BouncyCastleProvider

Answer 1

根本原因很可能是缺少对最新的基于EC的密码套件的支持，如TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

椭圆曲线密码(ECC)是由sunec提供程序实现的。要充分发挥功能，必须具备以下条件：

• 必须在jre/lib/security/java.security中列出SUNEC，并且jdk.tls.DisabledAlgorithms的值不能包含ECDHE
• 本机库libsunce.so/sunce.dll必须在jre/lib(Linux、Mac)或jre/bin（Windows）文件夹中可用
• 确保JDK JCE框架使用无限策略。由于Java8U161是新的默认值，对于旧版本，您可能必须安装JCE无限强度管辖策略文件和/或在Java.security文件中进行更改。有关进一步说明，请参阅此处。