All geek questions in one place

Why am I getting a handshake rejection (Java SSL)

I connect to the web service via HTTPS. I did everything that I think is required for it to work, but in the end I get a handshake rejection.

I found out that as a new user I can’t post more than two links due to “spam protection” - thanx a lot of stackoverflow ... anyway here is a link to a pastebin message with all the links specified..so when I write " link # 1 "here, this is a link to these links: http://pastebin.com/y4zGNRC7

  • I checked the same behavior with HttpClient (GET on the service url) and actually called the web service through the CXF proxy
  • I install the keystore and trust store - I tried both the "code" (link # 1) and set the system properties - that is, System.setProperty ("javax.net.ssl.keyStore", "mykeystore" .jks ");
  • SSL debugging enabled (javax.net.debug = all)
  • SSL debugging erodes the contents of both the keystore and trust (that is, it seems that java "knows about them") - link # 2
  • There seems to be some client-server communication going on there, but then it crashes for some reason link # 3
  • I successfully connected to the server using client and CA certificates both in the browser (Chrome) and using openssl s_client
  • wireshark shows less client-server conversations from java (link # 4), then, for example, from Chrome (link # 5)

Another strange thing: it seems to me that I get the same behavior when I install the keystore and when not (the only difference is that when the contents of the keystore are printed on the console, but that it is).

I tried to solve the problem, and I saw a lot of similar messages here in stackoverflow, but nothing helped. I tried changing the protocol version ("TLSv1", "SSLv3", even weird Hello v2). Any help would be appreciated - maybe there are some fundamental things that I could lose sight of ... I am desperate to run here ... Thanx

PS I am running java 1.6 update 30 on Fedora Core 15 (64 bit)

+6
source share
3 answers

The problem was that although the keystore and trust store were installed, java decided not to send the client certificate to the server. The reason for this was the fact that the server requested a certificate signed by the authority of RootCA, but the client certificate is signed by SubCA (which is issued by RootCA).

Initially, the keystore only contained a client certificate and a SubCA certificate of attorney. Then I tried to add a SubCA certificate to the keystore, but Java just ignored it.

So this solves the hanhake mystery problem, but not my problem.

I created a separate question for this ... sigh :-( Why doesn’t Java send the client certificate during SSL confirmation?

+4
source

You do not provide enough information, but I assume that your client trust store is not configured correctly. Truststore contains trusted certificates that are used to sign other certificates, and must include the root certificate (s) for the server and client certificate chains. The client keystore contains the SSL client certificate and private key.

+2
source

I think CA-free trust storage is the most likely problem. You can use the Java keytool to import the certificate for the site into the cacerts file by doing something like:

 keytool -keystore pathtocacerts -import -trustcacerts -v -alias aliasName -file root.crt

The default password for cacerts keystore is changeit . The cacerts usually located in the jre/lib/security directory.

+1
source

Source: https://habr.com/ru/post/908257/

More articles:


All Articles