( handshake_failure )：收到致命警报:handshake_failure

Question

在我的java spring引导应用程序(openjdk版本"11.0.12")中的“生产客户端完成握手消息”步骤之后，我得到了ssl握手异常。

org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://server/api/": Received fatal alert: handshake_failure; nested exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:785)

有人能帮忙吗？我在堆栈溢出中引用了多篇文章，并尝试了所有步骤。我不确定我是否错过了任何一步？

我正在编写一个java spring引导应用程序来测试双向SSL连接。我已经完成了以下步骤

1. 遵循下面的文章，然后以与https://www.aurigait.com/blog/how-to-implement-2-way-ssl-using-spring-boot/一样的方式使用RestTemplate创建应用程序(我没有创建自签名证书，而是使用为我们的项目创建的证书)
2. --我拥有客户端应用程序的JKS文件。将服务器公共证书作为信任源添加到客户端JKS文件中。我还将根CA作为信任source.
3. Provided添加到IntelliJ Run ->编辑配置-> VM Options

中

-Djavax.net.debug=all
-Dhttps.protocols=TLSv1.2,TLSv1.1,TLSv1 (Tried without this line also)
-Djavax.net.ssl.trustStore=C:\certificate\keystore.jks
-Djavax.net.ssl.trustStorePassword=pass
-Djavax.net.ssl.trustStore=C:\certificate\keystore.jks
-Djavax.net.ssl.trustStorePassword=pass

1. 服务器添加了客户端公共证书以及信任源.

错误：

)
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.190 UTC|Finished.java:398|Produced client Finished handshake message (
"Finished": {
  "verify data": {
    0000: AA 4E 76 43 21 C8 E4 D5   4A 5F B6 4F 
  }'}
)
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.190 UTC|SSLSocketOutputRecord.java:241|WRITE: TLS12 handshake, length = 24
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.206 UTC|SSLCipher.java:1743|Plaintext before ENCRYPTION (
  0000: 14 00 00 0C AA 4E 68 43   84 C8 E4 D5 4A 5F B6 4F  .....NhC....J_.O
)
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.206 UTC|SSLSocketOutputRecord.java:255|Raw write (
  0000: 16 03 03 00 34 00 00 00   00 00 00 00 00 DE 91 8F  ....(...........
  0010: 18 3B DC D0 84 2C 39 35   B0 3C C3 7E 9E 1C BF 27  .;...,95.<.....'
  0020: 10 23 E3 D0 D0 32 B8 D1   D2 5C C4 DA CC           .#.......\...
)
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.206 UTC|SSLSocketInputRecord.java:488|Raw read (
  0000: 15 03 03 00 02                                     .....
)
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.206 UTC|SSLSocketInputRecord.java:214|READ: TLSv1.2 alert, length = 2
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.206 UTC|SSLSocketInputRecord.java:488|Raw read (
  0000: 02 28                                              .(
)
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.206 UTC|SSLSocketInputRecord.java:247|READ: TLSv1.2 alert, length = 2
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 10:30:01.206 UTC|Alert.java:238|Received alert message (
"Alert": {
  "level"      : "fatal",
  "description": "handshake_failure"
}
)
javax.net.ssl|ERROR|16|scheduling-1|2022-08-26 10:30:01.206 UTC|TransportContext.java:341|Fatal (HANDSHAKE_FAILURE): Received fatal alert: handshake_failure (
"throwable" : {
.
.
.
javax.net.ssl|ALL|16|scheduling-1|2022-08-26 09:42:15.234 UTC|SSLSessionImpl.java:784|Invalidated session:  Session(1661506935062|SSL_NULL_WITH_NULL_NULL)
javax.net.ssl|ALL|16|scheduling-1|2022-08-26 09:42:15.234 UTC|SSLSessionImpl.java:784|Invalidated session:  Session(1661506935124|TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256)
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 09:42:15.234 UTC|SSLSocketImpl.java:1656|close the underlying socket
javax.net.ssl|DEBUG|16|scheduling-1|2022-08-26 09:42:15.234 UTC|SSLSocketImpl.java:1675|close the SSL connection (initiative)
org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://server/api/": Received fatal alert: handshake_failure; nested exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:785)

Answer 1

造成此问题的根本原因是我传递的证书(JKS)没有证书链(Issuer details)。因此，SSL握手在“生成的客户端完成握手消息”之后失败。我使用了另一个包含整个链的JKS，并添加了服务器证书作为信任源。SSL握手和HTTPS调用如出一辙。