1

如何让球衣客户端使用 TLSv1.1？ 我正在尝试强制 com.sun.jersey.client.urlconnection.HTTPSProperties（球衣客户端代码最终进入此类）使用TLSv1.1（或 TLSv1）来编写确认服务器协议的测试代码。在设置客户端时，我执行以下操作：

SSLContext context = SSLContext.getInstance("TLSv1.1");
context.init(null, trustAll, new SecureRandom());
HTTPSProperties props = new HTTPSProperties(hv, context);
clientConfig.getProperties().put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES, props);

在 HTTPSProperties 内部（我下载了 1.x 源代码，所以这可能是错误的）我看到：

public void setConnection(HttpsURLConnection connection) {
    if (hostnameVerifier != null)
        connection.setHostnameVerifier(hostnameVerifier);
    connection.setSSLSocketFactory(sslContext.getSocketFactory());
}

如果我SSLContext.getInstance("TLS");改用，代码可以正常工作。我试过添加System.setProperty("https.protocols", "TLSv1.1");，但它仍然不起作用。上面的代码给出了堆栈跟踪：

Caused by: javax.net.ssl.SSLException: Received fatal alert: protocol_version
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
        at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:2020)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1127)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1580)
        at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1508)
        at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:352)
        at com.sun.jersey.client.urlconnection.URLConnectionClientHandler._invoke(URLConnectionClientHandler.java:240)
        at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:147)
        ... 22 more

我的服务器（Jetty 9.4.41）认为它允许 TLSV1.1。当我转储 sslFactory 时，我得到：

I. 2021-09-29 16:37:59. [main] SSL context: Server@239105a8[provider=null,keyStore=file:***,trustStore=null] -
STOPPED
    +> trustAll=false
    +> Protocol Selections
    |  +> Enabled size=3
    |  |  +> TLSv1.1
    |  |  +> TLSv1.2
    |  |  +> TLSv1.3
    |  +> Disabled size=3
    |     +> SSLv2Hello - ConfigExcluded:'SSLv2Hello', ConfigIncluded:NotSelected
    |     +> SSLv3 - ConfigExcluded:'SSLv3', ConfigIncluded:NotSelected JVM:disabled
    |     +> TLSv1 - ConfigExcluded:'TLSv1', ConfigIncluded:NotSelected JVM:disabled
    +> Cipher Suite Selections
       +> Enabled size=39
       |  +> TLS_AES_128_GCM_SHA256
       |  +> TLS_AES_256_GCM_SHA384
       |  +> TLS_DHE_DSS_WITH_AES_128_CBC_SHA
       |  +> TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
       |  +> TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
       |  +> TLS_DHE_DSS_WITH_AES_256_CBC_SHA
       |  +> TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
       |  +> TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
       |  +> TLS_DHE_RSA_WITH_AES_128_CBC_SHA
       |  +> TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
       |  +> TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
       |  +> TLS_DHE_RSA_WITH_AES_256_CBC_SHA
       |  +> TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
       |  +> TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
       |  +> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
       |  +> TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
       |  +> TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
       |  +> TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
       |  +> TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
       |  +> TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
       |  +> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
       |  +> TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
       |  +> TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
       |  +> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
       |  +> TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
       |  +> TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
       |  +> TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
       |  +> TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
       |  +> TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
       |  +> TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
       |  +> TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
       |  +> TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
       |  +> TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
       |  +> TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
       |  +> TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
       |  +> TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
       |  +> TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
       |  +> TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
       |  +> TLS_EMPTY_RENEGOTIATION_INFO_SCSV
       +> Disabled size=6
          +> TLS_RSA_WITH_AES_128_CBC_SHA - ConfigExcluded:'^TLS_RSA_.*$'
          +> TLS_RSA_WITH_AES_128_CBC_SHA256 - ConfigExcluded:'^TLS_RSA_.*$'
          +> TLS_RSA_WITH_AES_128_GCM_SHA256 - ConfigExcluded:'^TLS_RSA_.*$'
          +> TLS_RSA_WITH_AES_256_CBC_SHA - ConfigExcluded:'^TLS_RSA_.*$'
          +> TLS_RSA_WITH_AES_256_CBC_SHA256 - ConfigExcluded:'^TLS_RSA_.*$'
          +> TLS_RSA_WITH_AES_256_GCM_SHA384 - ConfigExcluded:'^TLS_RSA_.*$'

任何帮助表示赞赏！提前致谢。

4

2 回答 2

2

根据Jersey 3 官方文档，您可以使用SslConfigurator并构建 SSL 上下文，如下所示：

SslConfigurator sslConfig = SslConfigurator.newInstance()
    //...
    .securityProtocol("TLSv1.1");

 SSLContext sslContext = sslConfig.createSSLContext();

此处列出了 SSLContext 支持的安全协议。

如果问题仍然存在，您应该遵循标准 诊断程序。请特别注意-Djdk.tls.client.protocols=TLSv1.1,TLSv1.2哪些控制底层平台 TLS 实现，如此处所述。

最后，您可以诉诸jdk.tls.disabledAlgorithms并明确禁用 TLSv1 -Djdk.tls.disabledAlgorithms=SSLv3,TLSv1。但是请注意，这将影响所有TLS 连接。

于 2021-09-30T13:02:31.867 回答
1

我将问题简化为如何强制客户端使用 TLSv1.1

我放弃了使用 jersey 客户端，只使用了 HttpsURLConnection。事实证明，使用 System.setProperties 并不是一个理想的选择，但是 Tasos P. 的诊断链接给了我 SSL Labs 的 ViewMyClient。

下面的代码导致报告 SSL 3、TLS 1.0 和 1.1 可用，但 TLS 1.2、1.3 和 SSL 2 不可用。

// Using these breaks things!
//System.setProperty( "https.protocols", "TLSv1,TLSv1.1" );
//System.setProperty( "jdk.tls.disabledAlgorithms", "SSLv2Hello,SSLv3,TLSv1" );
String requestedProtocol = "TLSv1.1";
testOutput.reportHeader( "SSLLabs " + requestedProtocol );

SSLContext cx = SSLContext.getInstance( requestedProtocol );
cx.init( null, trustAll, new SecureRandom() );
testOutput.report( "Protocol: " + cx.getProtocol() );
testOutput.report( "Provider: " + cx.getProvider().toString() );
StringBuilder sb = new StringBuilder();
javax.net.ssl.SSLParameters p = cx.getSupportedSSLParameters();
sb.append( "Protocols={" );
for( String s : p.getProtocols() ) {
    sb.append( s ).append( ',' );
}
sb.append( '}' );
testOutput.report( "SupportedSSLParameters: " + sb.toString() );
testOutput.report( "" );

int read;
byte[] bytes = new byte[1024];
final URL url = new URL(
    "https://clienttest.ssllabs.com:8443/ssltest/viewMyClient.html" );
HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setSSLSocketFactory( cx.getSocketFactory() );
conn.setHostnameVerifier( hv );
try {
    testOutput.report( "Response Message: " + conn.getResponseMessage() );
    InputStream in = conn.getInputStream();
    File file = new File( filename );
    FileOutputStream outputStream = new FileOutputStream( file );

    while( (read = in.read(bytes)) != -1 ) {
        outputStream.write( bytes, 0, read );
    }
    outputStream.close();
    in.close();
    testOutput.report( "File " + filename + " written." );
} catch( Exception ex ) {
    testOutput.reportException( ex );
}
于 2021-09-30T23:39:34.253 回答