javax。网ssl。SSLHandshakeException：没有可协商的密码套件（致命错误：80：包装应用程序数据时出现问题）

Question

我正在使用jetty（9.4.12.v20180830）HTTPClient来调用RESTAPI。

SSL/TLS握手失败，出现以下异常跟踪。

我们是IBM java 1.8版本。

jdk。tls。客户协议定义为TLSv1.2。请求了SSLv3协议，但未启用。支持：【TLSv1、TLSv1.1、TLSv1.2】服务器\u默认值：【TLSv1、TLSv1.1、TLSv1.2】客户端\u默认值：【TLSv1.2】IBMJSSE2将使用SSLEngineImpl启用CBC保护。IBMJSSE2将允许每个com重新协商RFC 5746。ibm。jsse2.renegotiate设置为none或默认值IBMJSSE2在每个com的初始握手期间不需要重新协商指示符。ibm。jsse2.重新谈判。指标设置为可选或默认值时，IBMJSSE2不会在每个com重新协商期间针对对等证书检查执行身份检查。ibm。jsse2.重新谈判。同龄人cert.check设置为OFF或默认IBMJSSE2将允许客户端根据jdk发起重新协商。tls。RejectClientInitiatedNegotiation设置为FALSE或默认值IBMJSSE2将不允许在每个jdk重新协商期间更改不安全的服务器证书。tls。allowUnsafeServerCertChange设置为FALSE或default

Is initial handshake: true
%% No cached client session
HttpClient@21ffc2b4-32, fatal error: 80: problem wrapping app data
javax.net.ssl.SSLHandshakeException: No negotiable cipher suite
HttpClient@21ffc2b4-32, SEND TLSv1.2 ALERT:  fatal, description = internal_error
HttpClient@21ffc2b4-32, WRITE: TLSv1.2 Alert, length = 2
HttpClient@21ffc2b4-32, called closeOutbound()
HttpClient@21ffc2b4-32, closeOutboundInternal()
[Raw write]: length = 7
0000: 15 03 03 00 02 02 50                               ......P

java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: No negotiable cipher suite
        at org.eclipse.jetty.client.util.FutureResponseListener.getResult(FutureResponseListener.java:118)
        at org.eclipse.jetty.client.util.FutureResponseListener.get(FutureResponseListener.java:110)
        at

jdk.tls.client.protocols is defined as TLSv1.2
    SSLv3 protocol was requested but was not enabled
    SUPPORTED: [TLSv1, TLSv1.1, TLSv1.2]
    SERVER_DEFAULT: [TLSv1, TLSv1.1, TLSv1.2]
    CLIENT_DEFAULT: [TLSv1.2]
    IBMJSSE2 will enable CBC protection
    Using SSLEngineImpl.
    IBMJSSE2 will allow RFC 5746 renegotiation per com.ibm.jsse2.renegotiate set to none or default
    IBMJSSE2 will not require renegotiation indicator during initial handshake per com.ibm.jsse2.renegotiation.indicator set to OPTIONAL or default taken
    IBMJSSE2 will not perform identity checking against the peer cert check during renegotiation per com.ibm.jsse2.renegotiation.peer.cert.check set to OFF or default
    IBMJSSE2 will allow client initiated renegotiation per jdk.tls.rejectClientInitiatedRenegotiation set to FALSE or default
    IBMJSSE2 will not allow unsafe server certificate change during renegotiation per jdk.tls.allowUnsafeServerCertChange set to FALSE or default

    Is initial handshake: true
    %% No cached client session
    HttpClient@21ffc2b4-32, fatal error: 80: problem wrapping app data
    javax.net.ssl.SSLHandshakeException: No negotiable cipher suite
    HttpClient@21ffc2b4-32, SEND TLSv1.2 ALERT:  fatal, description = internal_error
    HttpClient@21ffc2b4-32, WRITE: TLSv1.2 Alert, length = 2
    HttpClient@21ffc2b4-32, called closeOutbound()
    HttpClient@21ffc2b4-32, closeOutboundInternal()
    [Raw write]: length = 7
    0000: 15 03 03 00 02 02 50                               ......P

    java.util.concurrent.ExecutionException: javax.net.ssl.SSLHandshakeException: No negotiable cipher suite
            at org.eclipse.jetty.client.util.FutureResponseListener.getResult(FutureResponseListener.java:118)
            at org.eclipse.jetty.client.util.FutureResponseListener.get(FutureResponseListener.java:110)
            at

下面是使用的示例代码，

public void initialise() {
        /*
         * This is to suppress Jetty logging framework, otherwise it will log
         * errors & traces into stderr. Create and set a dummy Jetty Framework
         * as the Jetty logger class.
         */
        System.setProperty("org.eclipse.jetty.util.log.class",
                "com.ibm.tivoli.netcool.integrations.transportmodule.JettyLoggerSink");

        if (sslEnabled) {
            try {
                logger.log(Level.FINEST, "Initializing secure connection");
                if (keyStoreFilename == null || keyStorePassword == null) {
                    throw new Exception(
                            "Key store filename or password not set.");
                }
                SslContextFactory sslContext = new SslContextFactory(false);
                sslContext.setKeyStorePath(keyStoreFilename);
                sslContext.setKeyStorePassword(keyStorePassword);               
                sslContext.setProtocol("TLSv1.2");                
                sslContext.start();
                client = new HttpClient(sslContext);
            } catch (Exception e) {
                initialise_successful = false;
            }
        } else {
            /*
             * Non-SSL client initialization
             */
            client = new HttpClient();
        }
        try {
            client.start();

        } catch (Exception e) {
            initialise_successful = false;
        }
        initialise_successful = true;
        logger.log(Level.FINEST,
                "HTTP client has been successfully initialized");
    }

任何帮助都将得到感谢。

Answer 1

这个问题完全是IBM维护的非标准JVM造成的（它不符合Java JVM标准，也不符合SSL/TLS标准）。

您的具体问题的核心是，IBM JVM出于某种原因没有为SSl/TLS密码套件使用RFC标准名称。

您必须手动配置密码套件排除和包含，才能实现任何功能。

首先，使用SslContextFactory.setExdu deCipherSuites（）将排除设置为空白，然后重试。（这会清除已知易受攻击的密码套件）。

排除的Cipher Suite的默认列表是JVM排除的内容、操作系统库排除的内容和Jetty排除的内容的组合。

// Jetty Exclusion List

private static final String[] DEFAULT_EXCLUDED_CIPHER_SUITES = {
    // Exclude weak / insecure ciphers
    "^.*_(MD5|SHA|SHA1)$",
    // Exclude ciphers that don't support forward secrecy
    "^TLS_RSA_.*$",
    // The following exclusions are present to cleanup known bad cipher
    // suites that may be accidentally included via include patterns.
    // The default enabled cipher list in Java will not include these
    // (but they are available in the supported list).
    "^SSL_.*$",
    "^.*_NULL_.*$",
    "^.*_anon_.*$"
};

然后，在决定使用此易受攻击的配置之前，必须通过SslContextFactory手动声明要限制使用的IBM JVM命名密码套件。setIncludeCipherSuites（…） 呼叫。