为什么我会遇到握手失败 (Java SSL)
我正在通过 HTTPS 连接到 Web 服务。我已经完成了我认为使其正常工作所需的所有操作，但最终我握手失败了。
我发现，作为一个新用户，由于“垃圾邮件防护”，我无法发布超过 2 个链接 - 非常感谢 stackoverflow...无论如何，这里有一个指向 Pastebin 帖子的链接，其中列出了所有链接...所以当我在这里写“link#1”，它是对这些链接的引用：http://pastebin.com/y4zGNRC7
- 我使用 HttpClient （在服务 URL 上获取）验证了相同的行为，并且实际上通过 CXF 代理调用 Web 服务
- 我正在设置密钥库和信任库 - 我尝试了“代码中”方式（ link#1 ）和设置系统属性 - 即 System.setProperty("javax.net.ssl.keyStore", "mykeystore.jks");
- SSL 调试已打开 ( javax.net.debug=all )
- SSL 调试脱口而出密钥库和信任库的内容（即看起来像 java“了解它们”） - link#2
- 似乎正在进行一些客户端-服务器通信，但随后由于某种原因崩溃了 link#3
- 我在浏览器（Chrome）中使用客户端和 CA 证书成功连接到服务器，并使用 openssl s_clientwireshark
- 显示了来自 java 的客户端-服务器对话（link#4）较少例如，来自 Chrome ( link#5 )
另一个奇怪的事情是，当我设置密钥库和不设置密钥库时，我似乎得到相同的行为（唯一的区别是当我设置密钥库内容时打印在控制台中，但就是这样）。
我尝试用谷歌搜索这个问题，我在 stackoverflow 上看到了许多类似的帖子，但没有任何帮助。 我尝试更改协议版本（“TLSv1”、“SSLv3”，甚至是奇怪的 v2 Hello）。 任何帮助将不胜感激 - 也许我可能忽略了一些基本的事情......我在这里变得绝望...... 感谢
PS 我正在 Fedora Core 15（64 位）上运行 java 1.6 update 30
I'm connecting to a web service over HTTPS. I've done all that I think is required to make it work, but in the end I get a handshake failure.
I found out that as a new user I can't post more than 2 links due to "spam protection" - thanx a lot stackoverflow...anyway here's a link to a pastebin post with all the links spelled out...so when I write "link#1" here it's a reference to these links: http://pastebin.com/y4zGNRC7
- I verified the same behavior using HttpClient (GET on the service URL) and actually calling the web service via a CXF proxy
- I'm setting both the keystore and truststore - I tried both the "in code" way ( link#1 ) and setting the system properties - i.e. System.setProperty("javax.net.ssl.keyStore", "mykeystore.jks");
- SSL debug is on ( javax.net.debug=all )
- SSL debug blurts out the contents of both keystore and truststore (i.e. looks like java "knows about them") - link#2
- seems like there's some client-server communication going on, but then it crashes for some reason link#3
- I successfully connected to the server using the client and CA certificates both in a browser (Chrome) and using openssl s_client
- wireshark shows less client-server talk from java ( link#4 ) then for example from Chrome ( link#5 )
Another strange thing is, that I seem to be getting the same behavior when I set the keystore and when I don't (the only difference is that when I do the keystore contents get printed in the console, but that's it).
I tried googling the problem and I saw numerous similar posts here on stackoverflow, but nothing helped.
I tried changing the protocol version ("TLSv1", "SSLv3", even the weird v2 Hello).
Any help would be appreciated - maybe there's some fundamental thing I might have overlooked...I'm getting desperate here...
Thanx
PS I'm running java 1.6 update 30 on Fedora Core 15 (64bit)
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
问题是，即使设置了密钥库和信任库，java 也决定不将客户端证书发送到服务器。原因是服务器请求由 RootCA 机构签名的证书，但客户端证书是由 SubCA 机构（由 RootCA 颁发）签名的。
最初，密钥库仅包含客户端证书，信任库包含 SubCA 证书。
然后我也尝试将 SubCA 证书添加到密钥库中，但 java 只是忽略了它。
所以这解决了 hanshake 失败之谜，但不是我的问题。
我为此创建了一个单独的问题...叹息:-(
为什么 java 在 SSL 握手期间不发送客户端证书？
The problem was that even though the keystore and truststore was set, java decided not to send the client certificate to the server. The reason for this was the fact, that the server requested a certificate signed by the RootCA authority, but the client certificate is signed by a SubCA authority (which is issued by the RootCA).
Originally the keystore only contained the client cert and the truststore the SubCA cert.
I then tried to add the SubCA cert to the keystore too, but java just ignored it.
So this solves the hanshake failure mystery, but not my problem.
I created a separate question for that...sigh :-(
why doesn't java send the client certificate during SSL handshake?
我认为不包含 CA 的信任存储是最有可能的问题。您可以使用 Java
keytool将站点的证书导入到cacerts文件中，执行以下操作：默认 cacerts 密钥库密码为
changeit。cacerts文件通常位于jre/lib/security目录下。I think the trust store not containing the CA is the most likely issue. You can use the Java
keytoolto import the certificate for the site into thecacertsfile doing something like:The default cacerts keystore password is
changeit. Thecacertsfile is usually underjre/lib/securitydirectory.您没有提供足够的信息，但我猜测您的客户端信任库配置不正确。信任库包含用于签署其他证书的受信任证书，并且必须包含服务器和客户端证书链的根证书。客户端密钥库包含客户端 SSL 证书和私钥。
You don't provide enough information, but I'm guessing your client truststore is not properly configured. The truststore contains the trusted certificates that are used to sign other certs, and must include the root certificate(s) for the server and client cert chains. The client keystore contains the client SSL certificate and private key.