Java1.6_45+;BouncyCastle+;TLS1.2抛出握手失败(40)(通知安全重新协商)
我的案子几乎快结束了 我在JDK1.6_u45上尝试使用BouncyCastle连接到TLS1.2上的https端点。 我已经在jre/lib/security下的cacerts中添加了端点公钥证书 但是,我得到的错误遵循不同的堆栈跟踪,如下所示:Java1.6_45+;BouncyCastle+;TLS1.2抛出握手失败(40)(通知安全重新协商),java,bouncycastle,tls1.2,jdk1.6,Java,Bouncycastle,Tls1.2,Jdk1.6,我的案子几乎快结束了 我在JDK1.6_u45上尝试使用BouncyCastle连接到TLS1.2上的https端点。 我已经在jre/lib/security下的cacerts中添加了端点公钥证书 但是,我得到的错误遵循不同的堆栈跟踪,如下所示: Exception in thread "Main Thread" org.bouncycastle.crypto.tls.TlsFatalAlert: handshake_failure(40) at org.bouncycastle.crypto
Exception in thread "Main Thread" org.bouncycastle.crypto.tls.TlsFatalAlert: handshake_failure(40)
at org.bouncycastle.crypto.tls.AbstractTlsPeer.notifySecureRenegotiation(Unknown Source)
at org.bouncycastle.crypto.tls.TlsClientProtocol.receiveServerHelloMessage(Unknown Source)
at org.bouncycastle.crypto.tls.TlsClientProtocol.handleHandshakeMessage(Unknown Source)
at org.bouncycastle.crypto.tls.TlsProtocol.processHandshakeQueue(Unknown Source)
at org.bouncycastle.crypto.tls.TlsProtocol.processRecord(Unknown Source)
at org.bouncycastle.crypto.tls.RecordStream.readRecord(Unknown Source)
at org.bouncycastle.crypto.tls.TlsProtocol.safeReadRecord(Unknown Source)
at org.bouncycastle.crypto.tls.TlsProtocol.blockForHandshake(Unknown Source)
at org.bouncycastle.crypto.tls.TlsClientProtocol.connect(Unknown Source)
at TLSSocketConnectionFactory$1.startHandshake(TLSSocketConnectionFactory.java:498)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:167)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:134)
at CopyOfTest.getResponseJsonString(CopyOfTest.java:40)
at CopyOfTest.main(CopyOfTest.java:15)
BouncyCastle TLSSocketConnectionFactory与此链接中提供的工厂相同,因此我不再在此发布。(链接:
我的测试等级如下:
import java.io.BufferedReader;
import java.io.IOException;
import java.io.InputStreamReader;
import java.net.URL;
import javax.net.ssl.HttpsURLConnection;
import com.google.gson.Gson;
public class CopyOfTest {
public static void main(String[] args) throws IOException, Exception {
//below url is a not an actual endpoint.
URL url = new URL(
"https://abc.def.ghi/Customer/v1/nonexistantlink/?postalCode=80120&clientId=ABC");
String returnData = getResponseJsonString(url);
System.out.println("returnData: " + returnData);
ArrayNameDescDTO msg = new Gson().fromJson(returnData,
ArrayNameDescDTO.class);
System.out.println(msg.toString());
}
private static String getResponseJsonString(URL url) throws IOException {
// Security.addProvider(new BouncyCastleJsseProvider());
// SSLContext sslcontext = SSLContext.getInstance("TLS",new BouncyCastleJsseProvider())
HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setSSLSocketFactory(new TLSSocketConnectionFactory());
conn.setRequestMethod("GET");
byte[] message = ("username" + ":" + "andItsPassword").getBytes("UTF-8");
String encoded = javax.xml.bind.DatatypeConverter.printBase64Binary(message);
System.out.println("encoded: Basic " + encoded);
conn.setRequestProperty("Authorization", "Basic " + encoded);
conn.setConnectTimeout(10000); // 10 sec
conn.connect();
int status = conn.getResponseCode();
if (conn.getResponseCode() != 200) {
throw new RuntimeException("Failed : HTTP error code : "
+ conn.getResponseCode());
}
switch (status) {
case 200:
case 201:
BufferedReader br = new BufferedReader(new InputStreamReader(
conn.getInputStream()));
StringBuilder sb = new StringBuilder();
String line;
while ((line = br.readLine()) != null) {
sb.append(line + "\n");
}
br.close();
conn.disconnect();
return sb.toString();
}
conn.disconnect();
return null;
}
}
有任何建议或建议吗?此解决方案由@James restore Monica Polk提供。我将此解决方案重新发布在此处,以便其他人可以从中受益 解决方案是创建一个新的TLS客户端,该客户端扩展“org.bouncycastle.crypto.TLS.DefaultTlsClient”并覆盖“notifySecureRenegotiation”方法。 如下所示:
import org.bouncycastle.crypto.tls.DefaultTlsClient;
public class NewDefaultTlsClient extends DefaultTlsClient{
@Override
public void notifySecureRenegotiation(boolean secureRenegotiation){
//do nothing here
}
@Override
public org.bouncycastle.crypto.tls.TlsAuthentication getAuthentication()
throws IOException {
// TODO Auto-generated method stub
return null;
}
}
现在,在TLSSocketConnectionFactory上,转到startAndShake()方法,并更改
tlsClientProtocol.connect(new DefaultTlsClient(){ ....
与
就是这样!在上述更改之后,上述错误停止显示,JDK6代码能够命中TLS1.2端点。您使用的是什么版本的bouncycastle库?BC源代码和RFC 5246有点慢,但看起来服务器不支持安全重新协商。TLS 1要求这样做。2规范,因此BC TLS客户端中止握手。我尝试了“bcprov-jdk15on-164”和“bcprov-jdk16-1.46”两种方法。最终得到了相同的错误。我在这个网站上找到了关于RFC 5746的一些信息:“”。这里的人说“只需在客户端中重写“notifySecureRenegotiation”方法,而在该方法中什么都不做”但是TLSSocketConnectionFactory似乎没有这个方法可以重写,所以我很困惑OP是在哪里添加这个重写方法来让它为他工作的。我想你可以在你的method您将看到BC tls协议实例是以
DefaultTlsClient
的实例启动的。您需要子类化DefaultTlsClient
以覆盖notifySecureRenegotiation()
方法。
tlsClientProtocol.connect(new NewDefaultTlsClient(){ ....