All geek questions in one place

SSLHandshakeException due to lack of TLS encryption sets in Domino JVM

In my XPages application, the following exception occurs when I try to open an HTTPS connection with another server that only allows TLSv1 and newer (without SSLv3):

javax.net.ssl.SSLHandshakeException: No appropriate protocol

Setting javax.net.debug=ssl:handshake provides additional information:

 SSLContextImpl: Using X509ExtendedKeyManager com.ibm.jsse2.hd SSLContextImpl: Using X509TrustManager com.ibm.jsse2.pc IBMJSSE2 will ignore com.ibm.jsse2.overrideDefaultProtocol since was set to a non recognized value TLSv1 Installed Providers = IBMJSSE2, IBMJCE, IBMJGSSProvider, IBMCertPath, IBMSASL, IBMXMLCRYPTO, IBMXMLEnc, Policy, IBMSPNEGO JsseJCE: Using SecureRandom IBMSecureRandom from provider IBMJCE version 1.2 trigger seeding of SecureRandom done seeding SecureRandom IBMJSSE2 will enable CBC protection IBMJSSE2 to send SCSV Cipher Suite on initial ClientHello JsseJCE: Using SecureRandom IBMSecureRandom from provider IBMJCE version 1.2 IBMJSSE2 will allow RFC 5746 renegotiation per com.ibm.jsse2.renegotiate set to none or default IBMJSSE2 will not require renegotiation indicator during initial handshake per com.ibm.jsse2.renegotiation.indicator set to OPTIONAL or default taken IBMJSSE2 will not perform identity checking against the peer cert check during renegotiation per com.ibm.jsse2.renegotiation.peer.cert.check set to OFF or default IBMJSSE2 will not allow unsafe server certificate change during renegotiation per jdk.tls.allowUnsafeServerCertChange set to FALSE or default Is initial handshake: true JsseJCE: Using KeyAgreement ECDH from provider IBMJCE version 1.2 JsseJCE: Using signature SHA1withECDSA from provider TBD via init JsseJCE: Using signature NONEwithECDSA from provider TBD via init JsseJCE: Using KeyFactory EC from provider IBMJCE version 1.2 JsseJCE: Using KeyPairGenerator EC from provider TBD via init JsseJce: EC is available Ignoring disabled cipher suite: SSL_RENEGO_PROTECTION_REQUEST for TLSv1 No available cipher suite for TLSv1 Thread-8, handling exception: javax.net.ssl.SSLHandshakeException: No appropriate protocol Thread-8, SEND TLSv1 ALERT: fatal, description = handshake_failure

The main problem seems to be " There is no cipher suite available for TLSv1 ."

Retrieving standard and supported encryption sets ( getDefaultCipherSuites() / getSupportedCipherSuites() ) from the factory SSL server socket ( SSLServerSocketFactory.getDefault() ) shows that only SSL encryption packets are available in Domino JVM, but not for TLS.

The code I use to establish an HTTPS connection works fine in a JVM without Domino with TLS encryption sets.

Can someone tell me how to make the TLS encryption set available in the Domino JVM? Or in general, help me if there is another problem, and I misinterpreted the debugging information?

Additional information :

Version for Domino: 9.0.1 FP7

Java execution version: pwa6460sr16fp30-20160726_01 (SR16 FP30)

JVM version: JRE 1.6.0 IBM J9 2.4 Windows 7 amd64-64 jvmwa6460sr16fp30-20160725_312906 (JIT enabled, AOT enabled) J9VM - 20160725_312906 JIT - r9_20160725_121766 GC - GA24_Java6_SR16_2016072514

Domino JVM has unlimited JCE policy files installed.

+5
source share
1 answer

The problem seems to be related to how some Java SDKs limit the available encryption options . For example, the Dropbox Java SDK uses a hard-coded list of cipher names that begin with " TLS _ ". However, in the Domino JVM, all cipher suite names begin with " SSL _ ". As a result, all encryption blocks are disabled in the created SSL sockets, because none of their names matches.

+2
source

Source: https://habr.com/ru/post/1260411/

More articles:


All Articles