-1

我正在尝试构建一个 java 代码并运行 jar 文件。我正在使用 Java 1.8.0_201 运行 jar，但是在运行时由于握手失败，它无法从服务器生成令牌。这主要是由于协议不匹配造成的。（客户端在 TLSv1 中发送请求，服务器在 TLSv1.2 中返回，导致协议不匹配）

问题是为什么 java 1.8 在默认为 TLSv1.2 时使用 TLSv1。我检查了/jre/lib/security/java.security文件，那里的配置似乎很好。

Ignoring unsupported cipher suite: SSL_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: SSL_ECDH_RSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_128_GCM_SHA256
Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_128_GCM_SHA256
%% No cached client session
ALPNJSSEExt not initialzed for Client
*** ClientHello, TLSv1
RandomCookie:  GMT: 1538275877 bytes = { 241, 176, 51, 175, 86, 198, 212, 80, 127, 148, 227, 71, 225, 187, 76, 30, 151, 32, 213, 28, 179, 237, 196, 200, 111, 252, 126, 198 }
Session ID:  {}
Cipher Suites: [SSL_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_256_CBC_SHA, SSL_RSA_WITH_AES_256_CBC_SHA, SSL_ECDH_ECDSA_WITH_AES_256_CBC_SHA, SSL_ECDH_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_RSA_WITH_AES_256_CBC_SHA, SSL_DHE_DSS_WITH_AES_256_CBC_SHA, SSL_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_AES_128_CBC_SHA, SSL_ECDH_ECDSA_WITH_AES_128_CBC_SHA, SSL_ECDH_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_RSA_WITH_AES_128_CBC_SHA, SSL_DHE_DSS_WITH_AES_128_CBC_SHA]
Compression Methods:  { 0 }
Extension renegotiation_info, ri_length: 0, ri_connection_data: { null }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension extended_master_secret
Extension server_name, server_name: [type=host_name (0), value=<>]
***
[write] MD5 and SHA1 hashes:  len = 140
0000: 01 00 00 88 03 01 5c b0  3a 25 f1 b0 33 af 56 c6  ............3.V.
0010: d4 50 7f 94 e3 47 e1 bb  4c 1e 97 20 d5 1c b3 ed  .P...G..L.......
0020: c4 c8 6f fc 7e c6 00 00  1c c0 0a c0 14 00 35 c0  ..o...........5.
0030: 05 c0 0f 00 39 00 38 c0  09 c0 13 00 2f c0 04 c0  ....9.8.........
0040: 0e 00 33 00 32 01 00 00  43 ff 01 00 01 00 00 0a  ..3.2...C.......
0050: 00 0a 00 08 00 17 00 18  00 19 00 16 00 0b 00 02  ................
0060: 01 00 00 17 00 00 00 00  00 22 00 20 00 00 1d 73  ...............
0070: 64 70 2d 63 77 73 2e 73  64 70 31 32 2d 69 73 74  
0080: 67 2e 63 73 63 6f 2e 63  6c 6f 75 64              

main, WRITE: TLSv1 Handshake, length = 140
[Raw write]: length = 145
0000: 16 03 01 00 8c 01 00 00  88 03 01 5c b0 3a 25 f1  ................
0010: b0 33 af 56 c6 d4 50 7f  94 e3 47 e1 bb 4c 1e 97  .3.V..P...G..L..
0020: 20 d5 1c b3 ed c4 c8 6f  fc 7e c6 00 00 1c c0 0a  .......o........
0030: c0 14 00 35 c0 05 c0 0f  00 39 00 38 c0 09 c0 13  ...5.....9.8....
0040: 00 2f c0 04 c0 0e 00 33  00 32 01 00 00 43 ff 01  .......3.2...C..
0050: 00 01 00 00 0a 00 0a 00  08 00 17 00 18 00 19 00  ................
0060: 16 00 0b 00 02 01 00 00  17 00 00 00 00 00 22 00  ................
0070: 20 00 00 1d 73 64 70 2d  63 77 73 2e 73 64 70 31  ....
0080: 32 2d 69 73 74 67 2e 63  73 63 6f 2e 63 6c 6f 75  
0090: 64                                                 

[Raw read]: length = 5
0000: 15 03 01 00 02                                     .....

[Raw read]: length = 2
0000: 02 46                                              .F

main, READ: TLSv1 Alert, length = 2
main, RECV TLSv1.2 ALERT:  fatal, protocol_version
main, called closeSocket()
main, handling exception: javax.net.ssl.SSLException: Received fatal alert: protocol_version

clientHello 应该列出 TLSv1.2，但为什么它显示 TLSv1 ？由于客户端支持 TLSv1.2，而且我使用的是 java1.8

4

1 回答 1

0

对于过去使用 SSL 连接与第三方提供商交换数据的 API，我遇到了同样的问题。简单地说，我禁用了较低级别的安全算法。此设置强制服务器仅接受 TLSv1.2 连接。

jdk.tls.disabledAlgorithms= SSLv2Hello, SSLv3, TLSv1, TLSv1.1

在jre/lib/security/java.security文件中添加此参数应该可以解决您的问题。

于 2019-04-19T05:46:53.197 回答