【发布时间】：2017-02-16 19:41:55
【问题描述】：
我正在尝试使用嵌入式码头最新版本（9.4.x）运行 SSL。遵循以下步骤：
-
创建了一个jetty.xml，内容如下：
<Get name="ThreadPool"> <Set name="minThreads" type="int"><Property name="jetty.threadPool.minThreads" deprecated="threads.min" default="10"/></Set> <Set name="maxThreads" type="int"><Property name="jetty.threadPool.maxThreads" deprecated="threads.max" default="200"/></Set> <Set name="idleTimeout" type="int"><Property name="jetty.threadPool.idleTimeout" deprecated="threads.timeout" default="60000"/></Set> <Set name="detailedDump">false</Set> </Get> <!-- =========================================================== --> <!-- Add shared Scheduler instance --> <!-- =========================================================== --> <Call name="addBean"> <Arg> <New class="org.eclipse.jetty.util.thread.ScheduledExecutorScheduler"/> </Arg> </Call> <New id="httpConfig" class="org.eclipse.jetty.server.HttpConfiguration"> <Set name="secureScheme"><Property name="jetty.httpConfig.secureScheme" default="https" /></Set> <Set name="securePort"><Property name="jetty.httpConfig.securePort" deprecated="jetty.secure.port" default="8443" />8447</Set> <Set name="outputBufferSize"><Property name="jetty.httpConfig.outputBufferSize" deprecated="jetty.output.buffer.size" default="32768" /></Set> <Set name="outputAggregationSize"><Property name="jetty.httpConfig.outputAggregationSize" deprecated="jetty.output.aggregation.size" default="8192" /></Set> <Set name="requestHeaderSize"><Property name="jetty.httpConfig.requestHeaderSize" deprecated="jetty.request.header.size" default="8192" /></Set> <Set name="responseHeaderSize"><Property name="jetty.httpConfig.responseHeaderSize" deprecated="jetty.response.header.size" default="8192" /></Set> <Set name="sendServerVersion"><Property name="jetty.httpConfig.sendServerVersion" deprecated="jetty.send.server.version" default="true" /></Set> <Set name="sendDateHeader"><Property name="jetty.httpConfig.sendDateHeader" deprecated="jetty.send.date.header" default="false" /></Set> <Set name="headerCacheSize"><Property name="jetty.httpConfig.headerCacheSize" default="512" /></Set> <Set name="delayDispatchUntilContent"><Property name="jetty.httpConfig.delayDispatchUntilContent" deprecated="jetty.delayDispatchUntilContent" default="true"/></Set> <Set name="maxErrorDispatches"><Property name="jetty.httpConfig.maxErrorDispatches" default="10"/></Set> <Set name="blockingTimeout"><Property name="jetty.httpConfig.blockingTimeout" default="-1"/></Set> <Set name="persistentConnectionsEnabled"><Property name="jetty.httpConfig.persistentConnectionsEnabled" default="true"/></Set> </New> <Set name="handler"> <New id="Handlers" class="org.eclipse.jetty.server.handler.HandlerCollection"> <Set name="handlers"> <Array type="org.eclipse.jetty.server.Handler"> <Item> <New id="Contexts" class="org.eclipse.jetty.server.handler.ContextHandlerCollection"/> </Item> <Item> <New id="DefaultHandler" class="org.eclipse.jetty.server.handler.DefaultHandler"/> </Item> </Array> </Set> </New> </Set> <!-- =========================================================== --> <!-- extra server options --> <!-- =========================================================== --> <Set name="stopAtShutdown"><Property name="jetty.server.stopAtShutdown" default="true"/></Set> <Set name="stopTimeout"><Property name="jetty.server.stopTimeout" default="5000"/></Set> <Set name="dumpAfterStart"><Property name="jetty.server.dumpAfterStart" deprecated="jetty.dump.start" default="false"/></Set> <Set name="dumpBeforeStop"><Property name="jetty.server.dumpBeforeStop" deprecated="jetty.dump.stop" default="false"/></Set> <New id="sslHttpConfig" class="org.eclipse.jetty.server.HttpConfiguration"> <Arg><Ref refid="httpConfig"/></Arg> <Call name="addCustomizer"> <Arg> <New class="org.eclipse.jetty.server.SecureRequestCustomizer"> <Arg name="sniHostCheck" type="boolean"><Property name="jetty.ssl.sniHostCheck" default="true"/></Arg> <Arg name="stsMaxAgeSeconds" type="int"><Property name="jetty.ssl.stsMaxAgeSeconds" default="-1"/></Arg> <Arg name="stsIncludeSubdomains" type="boolean"><Property name="jetty.ssl.stsIncludeSubdomains" default="false"/></Arg> </New> </Arg> </Call> </New> <New id="sslContextFactory" class="org.eclipse.jetty.util.ssl.SslContextFactory"> <Set name="KeyStorePath">trust.jks</Set> <Set name="KeyStorePassword">testpwd</Set> <Set name="KeyManagerPassword">testpwd</Set> <Set name="TrustStorePath">trust.jks</Set> <Set name="TrustStorePassword">testpwd</Set> <Set name="EndpointIdentificationAlgorithm"/> <Set name="keyStoreType">JKS</Set> <Set name="keyStoreProvider">SUN</Set> <Set name="trustStoreType">JKS</Set> <!-- <Set name="protocol">TLS</Set>--> <Set name="renegotiationAllowed">true</Set> <Set name="includeProtocols"> <Array type="java.lang.String"> <Item>SSLv2Hello</Item> <Item>SSLv3</Item> <Item>TLSv1</Item> <Item>TLSv1.1</Item> <Item>TLSv1.2</Item> </Array> </Set> <Set name="IncludeCipherSuites"> <Array type="java.lang.String"> <item>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256</item> <item>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256</item> <item>TLS_RSA_WITH_AES_128_CBC_SHA256</item> <item>TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256</item> <item>TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256</item> <item>TLS_DHE_RSA_WITH_AES_128_CBC_SHA256</item> <item>TLS_DHE_DSS_WITH_AES_128_CBC_SHA256</item> <item>TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA</item> <item>TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA</item> <item>TLS_RSA_WITH_AES_128_CBC_SHA</item> <item>TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA</item> <item>TLS_ECDH_RSA_WITH_AES_128_CBC_SHA</item> <item>TLS_DHE_RSA_WITH_AES_128_CBC_SHA</item> <item>TLS_DHE_DSS_WITH_AES_128_CBC_SHA</item> <item>TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256</item> <item>TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256</item> <item>TLS_RSA_WITH_AES_128_GCM_SHA256</item> <item>TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256</item> <item>TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256</item> <item>TLS_DHE_RSA_WITH_AES_128_GCM_SHA256</item> <item>TLS_DHE_DSS_WITH_AES_128_GCM_SHA256</item> <item>TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA</item> <item>TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA</item> <item>SSL_RSA_WITH_3DES_EDE_CBC_SHA</item> <item>TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA</item> <item>TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA</item> <item>SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA</item> <item>SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA</item> <item>TLS_EMPTY_RENEGOTIATION_INFO_SCSV</item> <item>TLS_DH_anon_WITH_AES_128_GCM_SHA256</item> <item>TLS_DH_anon_WITH_AES_128_CBC_SHA256</item> <item>TLS_ECDH_anon_WITH_AES_128_CBC_SHA</item> <item>TLS_DH_anon_WITH_AES_128_CBC_SHA</item> <item>TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA</item> <item>SSL_DH_anon_WITH_3DES_EDE_CBC_SHA</item> <item>SSL_RSA_WITH_DES_CBC_SHA</item> <item>SSL_DHE_RSA_WITH_DES_CBC_SHA</item> <item>SSL_DHE_DSS_WITH_DES_CBC_SHA</item> <item>SSL_DH_anon_WITH_DES_CBC_SHA</item> <item>SSL_RSA_EXPORT_WITH_DES40_CBC_SHA</item> <item>SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA</item> <item>SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA</item> <item>SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA</item> <item>TLS_RSA_WITH_NULL_SHA256</item> <item>TLS_ECDHE_ECDSA_WITH_NULL_SHA</item> <item>TLS_ECDHE_RSA_WITH_NULL_SHA</item> <item>SSL_RSA_WITH_NULL_SHA</item> <item>TLS_ECDH_ECDSA_WITH_NULL_SHA</item> <item>TLS_ECDH_RSA_WITH_NULL_SHA</item> <item>TLS_ECDH_anon_WITH_NULL_SHA</item> <item>SSL_RSA_WITH_NULL_MD5</item> <item>TLS_KRB5_WITH_3DES_EDE_CBC_SHA</item> <item>TLS_KRB5_WITH_3DES_EDE_CBC_MD5</item> <item>TLS_KRB5_WITH_DES_CBC_SHA</item> <item>TLS_KRB5_WITH_DES_CBC_MD5</item> <item>TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA</item> <item>TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5</item> </Array> </Set> </New> <Call name="addConnector"> <Arg> <New id="sslConnector" class="org.eclipse.jetty.server.ServerConnector"> <Arg name="server"><Ref refid="Server" /></Arg> <Arg name="acceptors" type="int"><Property name="jetty.ssl.acceptors" deprecated="ssl.acceptors" default="-1"/></Arg> <Arg name="selectors" type="int"><Property name="jetty.ssl.selectors" deprecated="ssl.selectors" default="-1"/></Arg> <Arg name="factories"> <Array type="org.eclipse.jetty.server.ConnectionFactory"> <Item> <New class="org.eclipse.jetty.server.SslConnectionFactory"> <Arg name="next">http/1.1</Arg> <Arg name="sslContextFactory"> <Ref refid="sslContextFactory"/> </Arg> </New> </Item> </Array> </Arg> <Set name="host">192.168.10.129</Set> <Set name="port">8080</Set> <Set name="idleTimeout"><Property name="jetty.ssl.idleTimeout" deprecated="ssl.timeout" default="30000"/></Set> <Set name="soLingerTime"><Property name="jetty.ssl.soLingerTime" deprecated="ssl.soLingerTime" default="-1"/></Set> <Set name="acceptorPriorityDelta"><Property name="jetty.ssl.acceptorPriorityDelta" deprecated="ssl.acceptorPriorityDelta" default="0"/></Set> <Set name="acceptQueueSize"><Property name="jetty.ssl.acceptQueueSize" deprecated="ssl.acceptQueueSize" default="0"/></Set> </New> </Arg> </Call> </Configure> 使用以下命令创建证书：
keytool -genkey -alias jetty -keyalg RSA -keysize 1024 -validity 365 -keypass testpwd -keystore identity.jks -storepass testpwd
keytool -export -alias jetty -file root.cer -keystore identity.jks -storepass testpwd
keytool -import -alias jetty -file root.cer -keystore trust.jks -storepass testpwd- 使用 jetty-runner maven 插件创建了 jetty-runner jar
- 使用以下命令运行 jetty runner： java -Dsun.security.ssl.allowUnsafeRenegotiation=true -Djavax.net.debug=all -Djavax.net.debug=all:handshake:verbose -jar jetty-runner.jar --config jetty.xml my.war
服务器已启动，如指定端口和 SSL 上的日志文件所示，但尝试在浏览器或任何 http 客户端上打开时抛出握手错误。 javax.net.ssl.SSLHandshakeException：握手期间远程主机关闭连接。 原因：java.io.EOFException: SSL peer 关闭不正确。
【问题讨论】：
-
您使用
-Djavax.net.debug捕获的日志会告诉您发生了什么。常见原因：密码列表不兼容。 （顺便说一句，您的设置有语法错误，它的<Item>不是<item>）
标签： java ssl jetty maven-jetty-plugin