Jetty 支持来自 SoapUI 的 TLS 1.2 请求答案

【问题标题】：Jetty to support TLS 1.2 requests from SoapUIJetty 支持来自 SoapUI 的 TLS 1.2 请求
【发布时间】：2017-06-12 02:24:58
【问题描述】：

我正在努力构建一个接受 TLSv1.2 请求的嵌入式 Jetty 服务器。

这是Java代码：

private void launchHttpsListener() {

Server server = new Server(new InetSocketAddress(m_sAddress, m_nPort));

SslContextFactory sslContextFactory = new SslContextFactory();
sslContextFactory.setKeyStorePath("./keystore.jks");
sslContextFactory.setKeyStorePassword("Aa123456");
sslContextFactory.setKeyManagerPassword("Aa123456");
//sslContextFactory.setProtocol("TLSv1.2");
//sslContextFactory.setIncludeProtocols("TLSv1.2");

// Setup HTTP Configuration
HttpConfiguration httpConf = new HttpConfiguration();
httpConf.setSecurePort(m_nPort);
httpConf.setSecureScheme("https");
httpConf.addCustomizer(new SecureRequestCustomizer());

ContextHandler contextHandler = new ContextHandler();
contextHandler.setContextPath("/Service");
contextHandler.setHandler(new JettyServiceHandler());

ContextHandlerCollection contextHandlers = new ContextHandlerCollection();
contextHandlers.setHandlers(new Handler[] { contextHandler });

ServerConnector serverConnector = new ServerConnector(server,
    new SslConnectionFactory(sslContextFactory,"http/1.1"),
    new HttpConnectionFactory(httpConf));

serverConnector.setPort(m_nPort);

server.setConnectors(new Connector[]  { serverConnector });
server.setHandler(contextHandlers);

try {
    server.start();
    
    Log4jWrapper.writeLog(LogLevelEnum.INFO, "[-----------------] <JettyServiceListener> launchHttpsListener",
            "HTTPS Listener on " + m_sAddress + ":" + m_nPort);
    
    server.join();
} catch (InterruptedException e) {

    Log4jWrapper.writeLog(LogLevelEnum.ERROR, "[-----------------] <JettyServiceListener> launchHttpsListener",
            e.getMessage());
} catch (Exception e) {

    Log4jWrapper.writeLog(LogLevelEnum.ERROR, "[-----------------] <JettyServiceListener> launchHttpsListener",
            e.getMessage());
}

}

m_nPort = 9520

这是处理程序：

public class JettyServiceHandler extends AbstractHandler {

    @Override
    public void handle(String target, Request baseRequest, HttpServletRequest request, HttpServletResponse response)
            throws IOException, ServletException {

        Log4jWrapper.writeLog(LogLevelEnum.DEBUG, "[-----------------] <JettyServiceHandler> handle", "Received a notification...");
        
        String requestStr = convertStreamToString(baseRequest.getReader());

        Log4jWrapper.writeLog(LogLevelEnum.DEBUG, "[-----------------] <JettyServiceHandler> handle", "requestStr = " + requestStr);

               
        response.setContentType("text/html;charset=utf-8");
        response.setStatus(HttpServletResponse.SC_OK);
        baseRequest.setHandled(true);
        response.getWriter().println("1.2.1");
       
    }
    
    static String convertStreamToString(BufferedReader bufferedReader) {
        Stream<String> lines = bufferedReader.lines();
        return lines.collect(Collectors.joining("\n"));
    }
}

我从 SoapUI 向某个 https 地址 135.136.137.138:9520 发送一个非常简单的请求

目前我收到以下错误：

错误：javax.net.ssl.SSLHandshakeException：收到致命警报：握手失败

当然没有到达处理程序。

密钥库是自签名的。

我在 SoapUI-5.3.0.vmoptions 中添加了以下内容：

-Dsoapui.https.protocols=TLSv1.2

我哪里出错了？

【问题讨论】：

标签： java jetty soapui embedded-jetty tls1.2

【解决方案1】：

找到丢失的链接...

我添加了以下内容：

    sslContextFactory.setExcludeCipherSuites("SSL_RSA_WITH_DES_CBC_SHA",
                "SSL_DHE_RSA_WITH_DES_CBC_SHA", 
                "SSL_DHE_DSS_WITH_DES_CBC_SHA",
                "SSL_RSA_EXPORT_WITH_RC4_40_MD5",
                "SSL_RSA_EXPORT_WITH_DES40_CBC_SHA",
                "SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA",
               "SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA");

异常消失了！

【讨论】：

注意：排除列表与 TLS 支持级别无关。事实上，您的 *_RSA_*_SHA 匹配密码实际上不受现代浏览器的支持，在这种情况下没有任何意义。