Java 7 oracle不支持TLSv1.2
Java 7 oracle不支持TLSv1.2。 我一直在尝试运行我的代码,并尝试了以下操作:Java 7 oracle不支持TLSv1.2,java,java-7,tls1.2,tls1.1,Java,Java 7,Tls1.2,Tls1.1,Java 7 oracle不支持TLSv1.2。 我一直在尝试运行我的代码,并尝试了以下操作: System.setProperty("deployment.security.TLSv1.1", "false") System.setProperty("deployment.security.TLSv1", "false") System.setProperty("deployment.security.TLSv1.2", "true") System.setPr
System.setProperty("deployment.security.TLSv1.1", "false")
System.setProperty("deployment.security.TLSv1", "false")
System.setProperty("deployment.security.TLSv1.2", "true")
System.setProperty("https.protocols", "TLSv1.2")
System.setProperty("https.cipherSuites", "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,AES_256_GCM,TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384")
而这也无济于事
如何强制我的Java7应用程序使用Tlsv1.2。我可以使用java8运行我的程序,默认情况下,java8使用TLS1.2,而且一切都很好
我如何在oracle的Java7中实现这一点
我还尝试进入/usr/lib/jvm/java-7-oracle/jre/lib/security
并禁用了jdk.tls.disabledAlgorithms=SSLv2Hello,SSLv3,TLSv1
,但仍然不起作用
我怎么了
顺便说一句,我得到了sslhandshakeexception握手失败
编辑:
错误:
0000: 02 28 .(
main, READ: TLSv1 Alert, length = 2
main, RECV TLSv1 ALERT: fatal, handshake_failure
main, called closeSocket()
main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
166 [main] DEBUG org.apache.http.impl.conn.DefaultClientConnection - Connection org.apache.http.impl.conn.DefaultClientConnection@6b18e1c6 closed
166 [main] DEBUG org.apache.http.impl.conn.DefaultClientConnection - Connection org.apache.http.impl.conn.DefaultClientConnection@6b18e1c6 shut down
main, called close()
main, called closeInternal(true)
[main] DEBUG org.apache.http.impl.conn.BasicClientConnectionManager - Releasing connection org.apache.http.impl.conn.ManagedClientConnectionImpl@1f2dc289
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1979)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1086)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1332)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1359)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1343)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:533)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:401)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:177)
at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:304)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:611)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446)
at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:72)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:214)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:160)
我遇到了同样的问题,因为我是使用ApacheHTTP客户端库发出请求的,所以我用这种方式初始化我的HttpClient解决了这个问题
CloseableHttpClient client = HttpClients.custom()
.setSSLSocketFactory(getSSLContext())
.build();
其中getSSLContext()
方法是
private SSLConnectionSocketFactory getSSLContext() throws NoSuchAlgorithmException {
return new SSLConnectionSocketFactory(
SSLContext.getDefault(),
new String[]{"TLSv1.2"},
null,
new NoopHostnameVerifier());
}
如果有人有类似问题,我会回答自己的问题: 我花了两天的时间尝试了所有的东西,最后我找到了答案 在
Java-7-oracle
中,不可能使用TLS1.2。即使使用系统属性配置它,甚至在SSLContext级别设置它也帮不上我的忙。他们的支持很差。尽管在Java-8-oracle
中,这是可能的
只需将我的java更改为
java-7-openjdk-amd64
就可以了 您可以将Java 7版本升级到1.7.0_131-b31
对于Oracle站点中的JRE 1.7.0_131-b31:
TLS客户端上现在默认启用TLSv1.2和TLSv1.1
终点。这与JDK 8中已经发生的行为类似
释放
我遇到了类似的问题,无法在WebLogic 10.3中的Java JDK 1.7.0_80中启用TLSv1.2,我们将它升级到JDK 1.7.0_181,它开始为我们工作 我也有类似的问题,需要好几天才能解决所有问题。我无法更新我的JRE版本,因为它正在HSM上运行。也许除了我还有其他人有这样的要求 鉴于:
- JRE 1.7.0_25
- TOMCAT 8.0.9
BouncyCastleProvider provider = new BouncyCastleProvider();
Security.insertProviderAt(new BouncyCastleJsseProvider(provider), 1);
Security.insertProviderAt(provider, 2);
private static SSLContext createSSLContextBouncy(String base64Cert) {
BouncyCastleProvider provider = new BouncyCastleProvider();
Security.insertProviderAt(new BouncyCastleJsseProvider(provider), 1);
Security.insertProviderAt(provider, 2);
LOGGER.debug("Using bouncy castle as security provider");
try {
byte[] certBytes = Base64.decodeBase64(base64Cert);
X509Certificate cert =
(X509Certificate) CertificateFactory.getInstance("X.509", "BC").generateCertificate(new ByteArrayInputStream(certBytes));
KeyStore keystore = KeyStore.getInstance("BKS", "BC");
keystore.load(null);
keystore.setCertificateEntry("alias", cert);
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance("PKIX", "BCJSSE");
trustManagerFactory.init(keystore);
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
SSLContext sslContext = SSLContext.getInstance("TLS", "BCJSSE");
sslContext.init(null, trustManagers, new SecureRandom());
return sslContext;
} catch (Exception e) {
throw new RuntimeException(e);
}
}
而不是:
Security.insertProviderAt(new BouncyCastleProvider(), 2);
Security.insertProviderAt(new BouncyCastleJsseProvider(), 1);
但这让我想到了下一个问题:
问题3:
java.lang.SecurityException:JCE无法验证提供程序BC
解决方案:
BouncyCastle的最新jar(bcprov-jdk15on-162.jar)和之前的jar(bcprov-jdk15on-161.jar)没有为1.7.025正确签名,但bcprov-jdk15on-160.jar是。使用版本160后,我终于能够通过TLSv1.2连接到插座,代码如下:
BouncyCastleProvider provider = new BouncyCastleProvider();
Security.insertProviderAt(new BouncyCastleJsseProvider(provider), 1);
Security.insertProviderAt(provider, 2);
private static SSLContext createSSLContextBouncy(String base64Cert) {
BouncyCastleProvider provider = new BouncyCastleProvider();
Security.insertProviderAt(new BouncyCastleJsseProvider(provider), 1);
Security.insertProviderAt(provider, 2);
LOGGER.debug("Using bouncy castle as security provider");
try {
byte[] certBytes = Base64.decodeBase64(base64Cert);
X509Certificate cert =
(X509Certificate) CertificateFactory.getInstance("X.509", "BC").generateCertificate(new ByteArrayInputStream(certBytes));
KeyStore keystore = KeyStore.getInstance("BKS", "BC");
keystore.load(null);
keystore.setCertificateEntry("alias", cert);
TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance("PKIX", "BCJSSE");
trustManagerFactory.init(keystore);
TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();
SSLContext sslContext = SSLContext.getInstance("TLS", "BCJSSE");
sslContext.init(null, trustManagers, new SecureRandom());
return sslContext;
} catch (Exception e) {
throw new RuntimeException(e);
}
}
不幸的是,它在Tomcat内部仍然不起作用
问题4:
当我作为webapp(在Tomcat上)运行代码时,到TLSv1.2的连接仍然无法工作。握手正在开始,但结束时出现错误,显示“连接被拒绝”
解决方案:
在HSM上运行的Tomcat版本(可能还有其他版本)出于任何原因都需要30秒的握手时间,但端点的超时时间为10秒。我用另一个版本的Tomcat(8.0.37,因为我们知道HSM可能支持它)进行了测试,它运行得很顺利
希望这对任何人都有帮助。您的应用程序是否在tomcat下运行?不,不是。我正在向服务提出GET请求。有了java8,我可以很容易地做到这一点。此外,通过我的Chrome浏览器,我可以查看请求的输出。如何获取SSL上下文
SSLContext context=SSLContext.getInstance(“TLSv1.2”)代码>?最好粘贴stacktrace,让其他人来判断错误,而不是告诉你认为错误的地方。我也必须处理遗留应用程序,关键是将-Dhttps.protocols=TLSv1、TLSv1.1、TLSv1.2
传递给Java命令。如果这不起作用,答案可能是在apache HTTP中找到的,而不是运行时,很遗憾,我正在使用org.apache.HTTP.client.methods.HttpUriRequest。从一个我不想修改的超类导入,因为很多类都是从它继承的。这段代码是5年前别人写的该死,我在OpenJDK上,所以我必须进一步研究这段代码。我希望告诉我的团队“我们做不到!”