连接建立时出错：net :: ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Question

根据Digicert在下面的链接提供的说明，我已经在服务器上安装了SSL/TLS证书。 https://www.digicert.com/ssl-certificate-installation-java.htm

还定义了TrustManager，但仍然无法建立安全连接。 我得到连接失败的错误，原因“连接建立错误：net :: ERR_SSL_VERSION_OR_CIPHER_MISMATCH”

下面是我的代码添加SSL支持。

private static void addSSLSupport(DefaultIoFilterChainBuilder chain) 
     throws Exception { 
    try { 
     KeyStore keyStore=KeyStore.getInstance("JKS"); 
     char[] passphrase= {'t','e','s','t','s','s','l'}; 
     keyStore.load(new FileInputStream("/home/ec2-user/digicert/mydomain.jks"),passphrase); 
     Util.logInfo("Key Store loaded"); 
     SSLContext ctx=SSLContext.getInstance("TLS"); 
     TrustManagerFactory trustFactory=TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); 
     trustFactory.init(keyStore); 
     X509TrustManager defaultTrustManager = (X509TrustManager) trustFactory.getTrustManagers()[0]; 
     ctx.init(null, trustFactory.getTrustManagers(), null);    
     SslFilter sslFilter = new SslFilter(ctx); 
     chain.addLast("sslFilter", sslFilter); 
     Util.logInfo("SSL ON"); 
    }catch(Exception e){ 
     Util.logError(e.toString()); 
     throw e; 
    } 
} 

Answer 1

我在初始化SSLContext的时候使用了KeyManager而不是TrustManager。 以下是供您参考的代码。

private static void addSSLSupport(DefaultIoFilterChainBuilder chain) 
     throws Exception { 
    try { 
     KeyStore keyStore=KeyStore.getInstance("JKS"); 
     char[] passphrase= {'t','e','s','t','s','s','l'}; 
     keyStore.load(new FileInputStream("/root/mydomain.jks"),passphrase); 
     Util.logInfo("Key Store loaded"); 
     KeyManagerFactory kmf = KeyManagerFactory 
      .getInstance(KEY_MANAGER_FACTORY_ALGORITHM); 
     kmf.init(keyStore, passphrase); 
     SSLContext ctx=SSLContext.getInstance("TLS"); 
     ctx.init(kmf.getKeyManagers(), null, null);    
     SslFilter sslFilter = new SslFilter(ctx); 
     chain.addLast("sslFilter", sslFilter); 
     Util.logInfo("SSL ON"); 
    }catch(Exception e){ 
     Util.logError(e.toString()); 
     throw e; 
    } 
}