Java 1.6 TLS 1.2 握手失败答案

【问题标题】：Java 1.6 TLS 1.2 handshake_failureJava 1.6 TLS 1.2 握手失败
【发布时间】：2016-01-14 12:05:32
【问题描述】：

我正在尝试使用 java jdk 1.6.30 与使用 TLS 1.2 的 URI 通信，并且我尝试在我的系统上设置 BouncyCastle 提供程序，因为 java jdk 1.6.30 默认不支持 TLS 1.2 我还安装了我的本地计算机上的证书，但我收到以下错误：

Exception in thread "main" javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1806)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:986)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1197)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1181)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1014)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230)
    at main.main(main.java:22)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:140)

我使用的代码如下：

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import java.net.*;
import java.security.Security;

public class main {

    static {
        Security.addProvider(new BouncyCastleProvider());
    }

    public static void main(String[] args) throws Exception {
        final URL url = new URL("URL");
        final String postData = "POST_DATA";
        final byte[] postDataBytes = postData.getBytes("UTF-8");
        final HttpURLConnection httpURLConnection = (HttpURLConnection) url.openConnection();
        httpURLConnection.setRequestMethod("POST");
        httpURLConnection.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
        httpURLConnection.setRequestProperty("Content-Length", String.valueOf(postDataBytes.length));
        httpURLConnection.setDoOutput(true);
        httpURLConnection.getOutputStream().write(postDataBytes);
        httpURLConnection.getInputStream();
        System.out.println("OK");
    }
}

我尝试 google，但没有找到任何解决方案（TLS 1.2 + Java 1.6 + BouncyCastle、Received fatal alert: handshake_failure with Tomcat 等）。

我可以尝试信任证书吗？

提前致谢

【问题讨论】：

据我所知，您应该使用证书“keytool -import -alias foo -file C:/Users/xxx/xxxx.cer -keystore keystoreName”创建密钥工具
绝对需要使用 Java 6 吗？ Java 6 没有对 TLSv1.2 的内置支持。使用 Java 7 或更新版本会容易得多，因为它们确实支持 TLSv1.2。
我已使用 keytool 将证书添加到 java。另一方面，我需要使用 Java 6...如果我可以决定我将使用 Java 8 :)
以免在你打开的url连接之前添加这部分代码，看看结果是否改变； String javaHomePath = System.getProperty("java.home");字符串密钥库 = "C:\\.keystore";字符串 storepass = "changeit";字符串存储类型 = "JKS"; String[][] props = { { "javax.net.ssl.trustStore", keystore, }, { "javax.net.ssl.keyStore", keystore, }, { "javax.net.ssl.keyStorePassword", storepass , }, { "javax.net.ssl.keyStoreType", storetype, }, }; for (int i = 0; i
我刚刚尝试使用此代码，结果与使用“keytool -list”的结果相同，我可以看到正确导入的证书。我了解您的代码是为了检查我是否使用了正确的密钥库。

标签： java bouncycastle tls1.2

【解决方案1】：

你可以试试这段代码，我用的是 BouncyCastle 1.60 和 Java 1.6_65

BouncyCastleJsseProvider provider = new BouncyCastleJsseProvider(new BouncyCastleProvider());
SSLContext context = SSLContext.getInstance("TLS", provider);
TrustAllX509TrustManager manager = new TrustAllX509TrustManager();

context.init(null, new X509TrustManager[] { manager }, new SecureRandom());

URL url = new URL("https://stackoverflow.com:443");

HttpsURLConnection connection = (HttpsURLConnection) url.openConnection();
connection.setSSLSocketFactory(context.getSocketFactory());

connection.connect();

其实java 1.6的最新版本之一支持TLS 1.2 https://www.oracle.com/technetwork/java/javase/overview-156328.html#R160_121

【讨论】：