Java Web服务检查SSL握手警报：握手失败

我使用ApacheWink为webservice客户端编写了一个简单的方法。调用此方法时，我收到异常

javax.net.ssl.SSLProtocolException:handshake警报：handshake\u失败

String serviceURL = "https://eval-cloud2.castiron.com/envq/Development/url?id=" + id + "&ciUser=user&ciPassword=pass";  


System.setProperty("https.protocols", "SSLv3");
RestClient client = new RestClient();

Resource resource = client.resource(serviceURL);

try {
    text = resource.accept("text/plain").get(String.class);         
    } catch (ClientWebException e) {
    e.printStackTrace();
    } catch (Exception e) {     
    e.printStackTrace();
   } 

我添加了证书

keytool -import -alias castiron-trust -keystore "C:\Program Files\Java\jre7\lib\security\cacerts" -file "C:\Users\User1\Desktop\CastIron\castiron.cer" -storepass changeit

我已经打开了ssl调试

keyStore is : 
keyStore type is : jks
keyStore provider is : 
init keystore
init keymanager of type SunX509
trustStore is: C:\Program Files\Java\jre7\lib\security\cacerts
trustStore type is : jks
trustStore provider is : 
init truststore
adding as trusted cert:
  Subject: CN=SwissSign Platinum CA - G2, O=SwissSign AG, C=CH
  Issuer:  CN=SwissSign Platinum CA - G2, O=SwissSign AG, C=CH
  Algorithm: RSA; Serial number: 0x4eb200670c035d4f
  Valid from Wed Oct 25 11:36:00 FEST 2006 until Sat Oct 25 11:36:00 FET 2036

adding as trusted cert:
  Subject: CN=*.castiron.com, OU=IT, O=IBM Corporation, L=San Jose, ST=CA, C=US
  Issuer:  CN=DigiCert Secure Server CA, O=DigiCert Inc, C=US
  Algorithm: RSA; Serial number: 0x2d2bd48d2e347446f4a70e23e38c539
  Valid from Wed Sep 18 03:00:00 FET 2013 until Wed Nov 23 15:00:00 FET 2016

trigger seeding of SecureRandom
done seeding SecureRandom
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
http-apr-8080-exec-6, setSoTimeout(60000) called
%% No cached client session
*** ClientHello, SSLv3
RandomCookie:  GMT: 1370528261 bytes = { 248, 208, 114, 121, 205, 90, 4, 185, 164, 65, 92, 92, 105, 92, 32, 2, 25, 36, 246, 199, 196, 164, 41, 201, 136, 222, 122, 67 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension server_name, server_name: [host_name: eval-cloud2.castiron.com]
***
http-apr-8080-exec-6, WRITE: SSLv3 Handshake, length = 182
http-apr-8080-exec-6, READ: SSLv3 Alert, length = 2
http-apr-8080-exec-6, RECV TLSv1 ALERT:  warning, handshake_failure
SSL - handshake alert: handshake_failure
http-apr-8080-exec-6, handling exception: javax.net.ssl.SSLProtocolException: handshake alert:  handshake_failure
http-apr-8080-exec-6, SEND TLSv1 ALERT:  fatal, description = unexpected_message
http-apr-8080-exec-6, WRITE: TLSv1 Alert, length = 2
http-apr-8080-exec-6, called closeSocket()

---

我不知道你在哪里。请帮助我了解问题所在。

不久前，我遇到了这个问题，我使用以下java程序解决了这个问题，请记住使用生成的新cacerts覆盖您当前的cacerts

package com.aw.ad.util;
/*
 * Copyright 2006 Sun Microsystems, Inc.  All Rights Reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 *   - Redistributions of source code must retain the above copyright
 *     notice, this list of conditions and the following disclaimer.
 *
 *   - Redistributions in binary form must reproduce the above copyright
 *     notice, this list of conditions and the following disclaimer in the
 *     documentation and/or other materials provided with the distribution.
 *
 *   - Neither the name of Sun Microsystems nor the names of its
 *     contributors may be used to endorse or promote products derived
 *     from this software without specific prior written permission.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS
 * IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
 * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE COPYRIGHT OWNER OR
 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 */
/**
 * http://blogs.sun.com/andreas/resource/InstallCert.java
 * Use:
 * java InstallCert hostname
 * Example:
 *% java InstallCert ecc.fedora.redhat.com
 */

import javax.net.ssl.*;
import java.io.*;
import java.security.KeyStore;
import java.security.MessageDigest;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

/**
 * Class used to add the server's certificate to the KeyStore
 * with your trusted certificates.
 */
public class InstallCert {

    public static void main(String[] args) throws Exception {
        String host;
        int port;
        char[] passphrase;
        if ((args.length == 1) || (args.length == 2)) {
            String[] c = args[0].split(":");
            host = c[0];
            port = (c.length == 1) ? 443 : Integer.parseInt(c[1]);
            String p = (args.length == 1) ? "changeit" : args[1];
            passphrase = p.toCharArray();
        } else {
            System.out.println("Usage: java InstallCert <host>[:port] [passphrase]");
            return;
        }

        File file = new File("jssecacerts");
        if (file.isFile() == false) {
            char SEP = File.separatorChar;
            File dir = new File(System.getProperty("java.home") + SEP
                    + "lib" + SEP + "security");
            file = new File(dir, "jssecacerts");
            if (file.isFile() == false) {
                file = new File(dir, "cacerts");
            }
        }
        System.out.println("Loading KeyStore " + file + "...");
        InputStream in = new FileInputStream(file);
        KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
        ks.load(in, passphrase);
        in.close();

        SSLContext context = SSLContext.getInstance("TLS");
        TrustManagerFactory tmf =
                TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(ks);
        X509TrustManager defaultTrustManager = (X509TrustManager) tmf.getTrustManagers()[0];
        SavingTrustManager tm = new SavingTrustManager(defaultTrustManager);
        context.init(null, new TrustManager[]{tm}, null);
        SSLSocketFactory factory = context.getSocketFactory();

        System.out.println("Opening connection to " + host + ":" + port + "...");
        SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
        socket.setSoTimeout(10000);
        try {
            System.out.println("Starting SSL handshake...");
            socket.startHandshake();
            socket.close();
            System.out.println();
            System.out.println("No errors, certificate is already trusted");
        } catch (SSLException e) {
            System.out.println();
            e.printStackTrace(System.out);
        }

        X509Certificate[] chain = tm.chain;
        if (chain == null) {
            System.out.println("Could not obtain server certificate chain");
            return;
        }

        BufferedReader reader =
                new BufferedReader(new InputStreamReader(System.in));

        System.out.println();
        System.out.println("Server sent " + chain.length + " certificate(s):");
        System.out.println();
        MessageDigest sha1 = MessageDigest.getInstance("SHA1");
        MessageDigest md5 = MessageDigest.getInstance("MD5");
        for (int i = 0; i < chain.length; i++) {
            X509Certificate cert = chain[i];
            System.out.println
                    (" " + (i + 1) + " Subject " + cert.getSubjectDN());
            System.out.println("   Issuer  " + cert.getIssuerDN());
            sha1.update(cert.getEncoded());
            System.out.println("   sha1    " + toHexString(sha1.digest()));
            md5.update(cert.getEncoded());
            System.out.println("   md5     " + toHexString(md5.digest()));
            System.out.println();
        }

        System.out.println("Enter certificate to add to trusted keystore or 'q' to quit: [1]");
        String line = reader.readLine().trim();
        int k;
        try {
            k = (line.length() == 0) ? 0 : Integer.parseInt(line) - 1;
        } catch (NumberFormatException e) {
            System.out.println("KeyStore not changed");
            return;
        }

        X509Certificate cert = chain[k];
        String alias = host + "-" + (k + 1);
        ks.setCertificateEntry(alias, cert);

        OutputStream out = new FileOutputStream("jssecacerts");
        ks.store(out, passphrase);
        out.close();

        System.out.println();
        System.out.println(cert);
        System.out.println();
        System.out.println
                ("Added certificate to keystore 'jssecacerts' using alias '"
                        + alias + "'");
    }

    private static final char[] HEXDIGITS = "0123456789abcdef".toCharArray();

    private static String toHexString(byte[] bytes) {
        StringBuilder sb = new StringBuilder(bytes.length * 3);
        for (int b : bytes) {
            b &= 0xff;
            sb.append(HEXDIGITS[b >> 4]);
            sb.append(HEXDIGITS[b & 15]);
            sb.append(' ');
        }
        return sb.toString();
    }

    private static class SavingTrustManager implements X509TrustManager {

        private final X509TrustManager tm;
        private X509Certificate[] chain;

        SavingTrustManager(X509TrustManager tm) {
            this.tm = tm;
        }

        public X509Certificate[] getAcceptedIssuers() {
            throw new UnsupportedOperationException();
        }

        public void checkClientTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            throw new UnsupportedOperationException();
        }

        public void checkServerTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            this.chain = chain;
            tm.checkServerTrusted(chain, authType);
        }
    }

}

package com.aw.ad.util；
/*
*版权所有2006 Sun Microsystems，Inc.保留所有权利。
*
*以源代码和二进制形式重新分发和使用，带或不带
*如果满足以下条件，则允许进行修改
*满足以下条件：
*
*-源代码的重新分发必须保留上述版权
*请注意，此条件列表和以下免责声明。
*
*-二进制形式的重新分发必须复制上述版权
*请注意，此条件列表和中的以下免责声明
*随分发提供的文件和/或其他材料。
*
*-Sun Microsystems及其子公司的名称
*贡献者可用于支持或推广衍生产品
*未经事先书面许可，不得使用本软件。
*
*本软件由版权所有人和贡献者“作为
*以及任何明示或暗示的保证，包括但不限于：，
*对特定产品的适销性和适用性的默示保证
*目的是否认。在任何情况下，版权所有人或
*出资人对任何直接、间接、附带、特殊、，
*惩戒性或间接损害（包括但不限于，
*替代货物或服务的采购；使用、数据或服务的损失
*利润；或业务中断），无论是何种原因造成的
*责任，无论是合同责任、严格责任还是侵权责任（包括
*因使用本文件而产生的任何疏忽或其他原因）
*软件，即使已告知此类损坏的可能性。
*/
/**
* http://blogs.sun.com/andreas/resource/InstallCert.java
*使用：
*java InstallCert主机名
*例如：
*%java InstallCert ecc.fedora.redhat.com
*/
导入javax.net.ssl.*；
导入java.io.*；
导入java.security.KeyStore；
导入java.security.MessageDigest；
导入java.security.cert.CertificateException；
导入java.security.cert.x509证书；
/**
*类，用于将服务器的证书添加到密钥库
*使用您的可信证书。
*/
公共类安装证书{
公共静态void main（字符串[]args）引发异常{
字符串主机；
国际港口；
char[]密码短语；
如果（（args.length==1）| |（args.length==2））{
字符串[]c=args[0]。拆分（“：”；
主机=c[0]；
port=（c.length==1）？443:Integer.parseInt（c[1]）；
字符串p=（args.length==1）？“changeit”：args[1]；
密码短语=p.toCharArray（）；
}否则{
println（“用法：javainstallcert[：port][passphrase]”；
返回；
}
File File=新文件（“jssecacerts”）；
if（file.isFile（）==false）{
char SEP=File.separatorChar；
File dir=新文件（System.getProperty（“java.home”）+SEP
+“lib”+SEP+“证券”）；
文件=新文件（dir，“jssecacerts”）；
if（file.isFile（）==false）{
文件=新文件（目录，“cacerts”）；
}
}
System.out.println（“加载密钥库”+文件+”）；
InputStream in=新文件InputStream（文件）；
KeyStore ks=KeyStore.getInstance（KeyStore.getDefaultType（））；
ks.load（in，密码短语）；
in.close（）；
SSLContext context=SSLContext.getInstance（“TLS”）；
TrustManagerFactoryTMF=
TrustManagerFactory.getInstance（TrustManagerFactory.getDefaultAlgorithm（））；
tmf.init（ks）；
X509TrustManager defaultTrustManager=（X509TrustManager）tmf.getTrustManager（）[0]；
SavingTrustManager tm=新的SavingTrustManager（defaultTrustManager）；
init（null，new TrustManager[]{tm}，null）；
SSLSocketFactory=context.getSocketFactory（）；
System.out.println（“打开到“+主机+”：“+端口+”）；
SSLSocket套接字=（SSLSocket）工厂.createSocket（主机，端口）；
插座。设置插座输出（10000）；
试一试{
System.out.println（“启动SSL握手…”）；
socket.startHandshake（）；
socket.close（）；
System.out.println（）；
System.out.println（“无错误，证书已受信任”）；
}捕获（SSE）{
System.out.println（）；
e、 printStackTrace（系统输出）；
}
X509Certificate[]chain=tm.chain；
如果（链==null）{
System.out.println（“无法获取服务器证书链”）；
返回；
}
缓冲读取器=
新的BufferedReader（新的InputStreamReader（System.in））；
System.out.println（）；
System.out.println（“服务器发送”+chain.length+“证书：”）；
System.out.println（）；
MessageDigest sha1=MessageDigest.getInstance（“sha1”）；
MessageDigest md5=MessageDigest.getInstance（“md5”）；
对于（int i=0；ibcprov-ext-jdk15on-160.jar
bctls-jdk15on-1.57.jar

    Security.removeProvider(BouncyCastleProvider.PROVIDER_NAME);
    Security.insertProviderAt(new BouncyCastleProvider(), 1);

    Security.removeProvider(BouncyCastleJsseProvider.PROVIDER_NAME);
    Security.insertProviderAt(new BouncyCastleJsseProvider(), 2);

    TrustManager tm = new X509TrustManager() {
        public X509Certificate[] getAcceptedIssuers() {
            return new X509Certificate[0];
        }
        public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
            if (chain == null || chain.length < 1 || authType == null || authType.length() < 1) {
                throw new IllegalArgumentException();
            }
        }

        public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
        }
    };
    SSLContext sslContext = SSLContext.getInstance("TLSv1.2", BouncyCastleJsseProvider.PROVIDER_NAME);
    sslContext.init(null, new TrustManager[] { tm }, new SecureRandom());

    HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());

URL url = new URL("https://yourURL.com");

HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setRequestMethod("GET");
if (conn.getResponseCode() != 200) {
                throw new RuntimeException("Failed : HTTP error code : " + conn.getResponseCode());
            }
conn.disconnect();