“握手期间远程主机关闭连接”错误的原因是什么？

Question

我想使用 SSL 连接到 Oracle 数据库 11.2。但我收到的唯一错误是：

Exception in thread "main" java.sql.SQLException: I/O-Fehler: Remote host closed connection during handshake
    at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:465)
    at oracle.jdbc.driver.PhysicalConnection.<init>(PhysicalConnection.java:534)
    at oracle.jdbc.driver.T4CConnection.<init>(T4CConnection.java:217)
    at oracle.jdbc.driver.T4CDriverExtension.getConnection(T4CDriverExtension.java:28)
    at oracle.jdbc.driver.OracleDriver.connect(OracleDriver.java:527)
    at java.sql.DriverManager.getConnection(DriverManager.java:582)
    at java.sql.DriverManager.getConnection(DriverManager.java:154)
    at TestOracle.testSSL(TestOracle.java:157)
    at TestOracle.main(TestOracle.java:131)
Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:808)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1112)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:623)
    at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)
    at oracle.net.ns.Packet.send(Packet.java:420)
    at oracle.net.ns.ConnectPacket.send(ConnectPacket.java:169)
    at oracle.net.ns.NSProtocol.connect(NSProtocol.java:301)
    at oracle.jdbc.driver.T4CConnection.connect(T4CConnection.java:1406)
    at oracle.jdbc.driver.T4CConnection.logon(T4CConnection.java:327)
    ... 8 more
Caused by: java.io.EOFException: SSL peer shut down incorrectly
    at com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java:333)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:789)
    ... 16 more

我已将自签名证书添加到创建的钱包中。但是我不明白Oracle服务器如何使用它，因为它需要一个Oracle服务器不知道的密码。我必须看到密码吗？我必须在哪里设置？

在网络上，我可以看到 Oracle 服务器没有发送任何字节。它在客户端开始握手后关闭套接字。我认为问题出在服务器端。

我的听众.ora

SID_LIST_LISTENER =
(SID_LIST =
(SID_DESC =
  (SID_NAME = CLRExtProc)
  (ORACLE_HOME = C:\app\Administrator\product\11.2.0\dbhome_2)
  (PROGRAM = extproc)
  (ENVS = "EXTPROC_DLLS=ONLY:C:\app\Administrator\product\11.2.0\dbhome_2\bin\oraclr11.dll")
)
)

LISTENER =
(DESCRIPTION_LIST =
(DESCRIPTION =
  (ADDRESS = (PROTOCOL = TCP)(HOST = ora11.inetsoftware.local)(PORT = 1521))
  (ADDRESS = (PROTOCOL = TCPS)(HOST = ora11.inetsoftware.local)(PORT = 2484))
)
)

ADR_BASE_LISTENER = C:\app\Administrator

WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=C:\app\Administrator\product\11.2.0\dbhome_2\BIN\owm\wallets\Administrator)))
SSL_CLIENT_AUTHENTICATION=FALSE

我的 sqlnet.ora：

SQLNET.AUTHENTICATION_SERVICES= (NTS)

NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)

WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=C:\app\Administrator\product\11.2.0\dbhome_2\BIN\owm\wallets\Administrator)))
SSL_CLIENT_AUTHENTICATION=FALSE

Answer 1

证书没有密码。证书所在的东西有一个密码。您的客户端知道密码，从事物中获取证书，然后将证书发送到服务器。

如果服务器由于某种原因不喜欢证书，它可能会关闭连接而不是继续握手。如果您不按请求发送它也是如此，如果您的证书不满足服务器在证书请求中指定的约束，就会发生这种情况。例如，如果服务器无法识别自签名者。您是否已将证书导出到服务器的信任库？

Answer 2

我找到了解决方案。这很简单。首先你需要设置自动登录。这会在钱包目录中创建一个文件 cwallet.sso。而且最重要的是你在启动TNS监听服务的时候已经在钱包​​管理器中关闭了钱包。否则侦听器无法加载文件 cwallet.sso。在跟踪文件中您可以看到错误：

ntzlogin:Wallet open failed with error 28759

如果您稍后关闭钱包，这将无效。看起来监听器只读取了一次文件。