All geek questions in one place

"Upon receiving fatal warning: handshake_failure" when trying to connect to https web service

I want to create a Spring 3 application (v 3.1.1.RELEASE) (in Java 1.6) to communicate with the HTTPS web service, which uses the self-signed certificate that I created. I am confused about how to set up my trust stores and key tables. Using my self-signed certificate, I created a key stone using the commands below ...

openssl pkcs12 -export -in server.crt -inkey server.key \ -out server.p12 -name myalias keytool -importkeystore -deststorepass password -destkeypass password -deststoretype jks -destkeystore server.keystore -srckeystore server.p12 -srcstoretype PKCS12 -srcstorepass password -alias myalias

Then I set up my Spring application so ...

  <http-conf:conduit name="*.http-conduit"> <http-conf:tlsClientParameters secureSocketProtocol="SSL" disableCNCheck="true"> <sec:trustManagers> <sec:keyStore type="JKS" password="password" resource="server.keystore" /> </sec:trustManagers> <sec:keyManagers keyPassword="password"> <sec:keyStore type="pkcs12" password="password" resource="server.p12" /> </sec:keyManagers> </http-conf:tlsClientParameters> </http-conf:conduit> <jaxws:client id="orgWebServiceClient" serviceClass="org.mainco.bsorg.OrganizationWebService" address="${wsdl.url}" />

but when I run my application, I get the following error. What did I miss?

 Caused by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://nonprod.cbapis.org/qa2/bsorg/OrganizationService: Received fatal alert: handshake_failure at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) [classes.jar:1.6.0_45] at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:39) [classes.jar:1.6.0 _45] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:27) [classes.jar:1.6.0_45] at java.lang.reflect.Constructor.newInstance(Constructor.java:513) [classes.jar:1.6.0_45] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1458) [cxf-rt-transports-http-2.6.0.jar:2.6.0] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1443) [cxf-rt-transports-http-2.6.0.jar:2.6.0] at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56) [cxf-api-2.6.0.jar:2.6.0] at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:659) [cxf-rt-transports-http-2.6.0.jar:2.6.0] at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62) [cxf-api-2.6.0.jar:2.6.0] at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:262) [cxf-api-2.6.0.jar:2.6.0 ] at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:532) [cxf-api-2.6.0.jar:2.6.0] at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:464) [cxf-api-2.6.0.jar:2.6.0] at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:367) [cxf-api-2.6.0.jar:2.6.0] at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:320) [cxf-api-2.6.0.jar:2.6.0] at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:89) [cxf-rt-frontend-simple-2.6.0.jar:2.6.0] at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:134) [cxf-rt-frontend-jaxws-2.6.0.jar:2.6.0] ... 5 more Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174) [jsse.jar:1.6] at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136) [jsse.jar:1.6] at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1822) [jsse.jar:1.6] at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1004) [jsse.jar:1.6] at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1188) [jsse.jar:1.6] at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1215) [jsse.jar:1.6] at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1199) [jsse.jar:1.6] at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434) [jsse.jar:1.6] at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166) [jsse.jar:1.6] at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1014) [classes.jar:1.6.0_45] at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230) [jsse.jar:1.6] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1395) [cxf-rt-transports-http-2.6.0.jar:2.6.0] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1337) [cxf-rt-transports-http-2.6.0.jar:2.6.0] at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:42) [cxf-api-2.6.0.jar:2.6.0] at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69) [cxf-api-2.6.0.jar:2.6.0] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1415) [cxf-rt-transports-http-2.6.0.jar:2.6.0] ... 15 more
+6
source share
3 answers

If you do not use two-way SSL authentication, your server does not care about who the client is, so it does not need to check and verify the client certificate; then in this case all you need on the client side is just a trust store that contains a list of server trust certificates. In your case, your client supermarket will contain only the server certificate itself and that's it. A common practice in java is to have your power of attorney in .jks format. If you manage to create a trusted store, then you will be set up. On the server side, you do not need to worry about the power of attorney, but you need to configure the server to have a valid server certificate.

In two-way SSL authentication, you need a keystore and trust store configured on both the client side and the server side. The client trust network will remain the same as with one-way authentication. The trust server must contain a self-signed client certificate. Both the client and the server must be configured to use their respective certificates, which they present to each of them during SSL confirmation. During a handshake, both sides check each other with a certificate of attorney and establish the identity of the opposite side. And once the identifiers are set, you can establish a connection.

To create stores, I would suggest using the Portecle tool, which can be very useful.

+3
source

Here is a sequence of things to check:

  • Check your key store entry with keytool -list . See this article for syntax.
  • Check if there is a common set of supported cipher suites between your client and server.
  • Finally, specify the .jks file .jks both keyManagers and trustManagers as indicated in the cxf documentation
0
source

You must have the correct SSL certificate in the keystore of the server you are trying to connect to.

You can create a Keystore using the method here .

Check out these examples. They work for me.

example 1 example 2

0
source

Source: https://habr.com/ru/post/945017/

More articles:


All Articles