Java https有握手问题

我正在编写一个用java接受并响应ajax请求的https服务器。我有这一切与http连接工作，但https证明难以建立。如果我使用openssl，我可以打到服务器并按预期得到响应：openssl s_client -connect localhost:5001但来自浏览器的ajax调用失败。我不确定该从哪里出发。Java https有握手问题

这是来自服务器的attemped Ajax调用后的堆栈跟踪：

javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake 
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) 
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) 
at sun.security.ssl.SSLSocketImpl.writeRecord(Unknown Source) 
at sun.security.ssl.AppOutputStream.write(Unknown Source) 
at sun.nio.cs.StreamEncoder.writeBytes(Unknown Source) 
at sun.nio.cs.StreamEncoder.implFlushBuffer(Unknown Source) 
at sun.nio.cs.StreamEncoder.implFlush(Unknown Source) 
at sun.nio.cs.StreamEncoder.flush(Unknown Source) 
at java.io.OutputStreamWriter.flush(Unknown Source) 
at java.io.BufferedWriter.flush(Unknown Source) 
at com.myDomain.HttpsServer.main(HttpsServer.java:223) 
Caused by: java.io.EOFException: SSL peer shut down incorrectly 
at sun.security.ssl.InputRecord.read(Unknown Source) 
... 11 more

AJAX调用：

var command, req; 
    command = { 
    command: "getStatus", 
    }; 
    command = JSON.stringify(command); 
    req = $.ajax("https://localhost:5001", { 
    data: command, 
    dataType: "jsonp", 
    timeout: 1000 
    });

Java服务器：

private static SSLServerSocket createSSLSocket(){ 
    SSLServerSocketFactory sslServerSocketFactory = 
     (SSLServerSocketFactory) SSLServerSocketFactory.getDefault(); 
    try{ 
     SSLServerSocket sslSocket = 
     (SSLServerSocket) sslServerSocketFactory.createServerSocket(port, 10, InetAddress.getByName("127.0.0.1")); 
     return sslSocket; 
    } catch (Exception e){ 
     e.printStackTrace(); 
    } 
    return null; 
} 

public static void main (String args[]) throws Exception { 
    SSLServerSocket sslSocket; 
    sslSocket = createSSLSocket(); 

    while(running) { 
     SSLSocket connected = (SSLSocket) sslSocket.accept(); 
     try{ 
     BufferedWriter w = new BufferedWriter(
      new outputStreamWriter(connected.getOutputStream())); 
      BufferedReader r = new BufferedReader(
       new InputStreamReader(connected.getInputStream())); 
      w.write("HTTP/1.0 200 OK"); 
      w.write("foo"); 
      w.newLine(); 
      w.flush(); //THIS IS WHERE THE ACTUAL EXCEPTION IS THROWN (LINE 223) 
      w.close(); 
      r.close(); 
      connected.close(); 
     } catch (Exception e){ 
     e.printStackTrace(); 
     } 
    } 
}

这正与运行：

它看起来像正在使用mySrvKeystore适当时与调试选项来完成。

UPDATE

这里是从调试输出一些信息：

*** ECDH ServerKeyExchange 
Server key: Sun EC public key, 256 bits 
    public x coord:  59120686551233854673577061225846672012454441193286172303206804252170042475984 
    public y coord: 64356797475544123011351526783519675095229374542555548418334080869325161950574 
    parameters: secp256r1 [NIST P-256, X9.62 prime256v1] (1.2.840.10045.3.1.7) 
*** ServerHelloDone 
main, WRITE: TLSv1 Handshake, length = 1317 
main, received EOFException: error 
main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host closed connection  during handshake 
%% Invalidated: [Session-1, TLS_ECDHE_RSA_WITH_RC4_128_SHA] 
main, SEND TLSv1 ALERT: fatal, description = handshake_failure 
main, WRITE: TLSv1 Alert, length = 2 
main, called closeSocket()

来源

2012-05-22 Lee Quarella

是否在所有浏览器失效密码套件连接呢？有一个相同的堆栈跟踪的问题：http://stackoverflow.com/questions/4827190/exception-at-start-of-request-clientauth-ssl – Serxipc

你能找到任何与这个问题？谢谢 –

看起来这是一个特定于chrome的问题。检查这个家伙：http://stackoverflow.com/questions/7535154/chrome-closing-connection-on-handshake-with-java-ssl-server –

它可以是棘手确定这样的握手失败。尝试启用SSL/TLS调试使用：

-Djavax.net.debug=true

您可能还需要增加一个信任存储在服务器上：

-Djavax.net.ssl.trustStore=mySrvKeystore

的密码套件TLS_ECDHE_RSA_WITH_RC4_128_SHA可能不被你的浏览器支持正在使用。它可能是客户端/服务器尝试协商几个，并在最后一个失败。您可以使用服务器上打印出您启用的密码套件：

String[] cipherSuites = sslSocket.getEnabledCipherSuites(); 
for (int x = 0; x < cipherSuites.length; x++) { 
    System.out.println(cipherSuites[x]); 
}

您也可以考虑限制服务器提供使用sslSocket.setEnabledCipherSuites()选择密码。

查看Using AES in JSSE了解Sun的一些旧例子。

一般一个现代浏览器都可以用类似TLS_RSA_WITH_AES_128_CBC_SHA

来源

2012-06-03 20:53:49 pd40

Java https有握手问题

回答

相关问题