java - "Received fatal alert: handshake_failure" when trying to connect to https web service -
i want build spring 3 (v 3.1.1.release) application (on java 1.6) communicate https web service, using self-signed certificate created. i'm confused how set truststores , keystones. using self-signed certificate, generated keystone using below commands ...
openssl pkcs12 -export -in server.crt -inkey server.key \ -out server.p12 -name myalias keytool -importkeystore -deststorepass password -destkeypass password -deststoretype jks -destkeystore server.keystore -srckeystore server.p12 -srcstoretype pkcs12 -srcstorepass password -alias myalias then configured spring application …
<http-conf:conduit name="*.http-conduit"> <http-conf:tlsclientparameters securesocketprotocol="ssl" disablecncheck="true"> <sec:trustmanagers> <sec:keystore type="jks" password="password" resource="server.keystore" /> </sec:trustmanagers> <sec:keymanagers keypassword="password"> <sec:keystore type="pkcs12" password="password" resource="server.p12" /> </sec:keymanagers> </http-conf:tlsclientparameters> </http-conf:conduit> <jaxws:client id="orgwebserviceclient" serviceclass="org.mainco.bsorg.organizationwebservice" address="${wsdl.url}" /> but when run application, below error. have missed?
caused by: javax.net.ssl.sslhandshakeexception: sslhandshakeexception invoking https://nonprod.cbapis.org/qa2/bsorg/organizationservice: received fatal alert: handshake_failure @ sun.reflect.nativeconstructoraccessorimpl.newinstance0(native method) [classes.jar:1.6.0_45] @ sun.reflect.nativeconstructoraccessorimpl.newinstance(nativeconstructoraccessorimpl.java:39) [classes.jar:1.6.0 _45] @ sun.reflect.delegatingconstructoraccessorimpl.newinstance(delegatingconstructoraccessorimpl.java:27) [classes.jar:1.6.0_45] @ java.lang.reflect.constructor.newinstance(constructor.java:513) [classes.jar:1.6.0_45] @ org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.mapexception(httpconduit.java:1458) [cxf-rt-transports-http-2.6.0.jar:2.6.0] @ org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.close(httpconduit.java:1443) [cxf-rt-transports-http-2.6.0.jar:2.6.0] @ org.apache.cxf.transport.abstractconduit.close(abstractconduit.java:56) [cxf-api-2.6.0.jar:2.6.0] @ org.apache.cxf.transport.http.httpconduit.close(httpconduit.java:659) [cxf-rt-transports-http-2.6.0.jar:2.6.0] @ org.apache.cxf.interceptor.messagesenderinterceptor$messagesenderendinginterceptor.handlemessage(messagesenderinterceptor.java:62) [cxf-api-2.6.0.jar:2.6.0] @ org.apache.cxf.phase.phaseinterceptorchain.dointercept(phaseinterceptorchain.java:262) [cxf-api-2.6.0.jar:2.6.0 ] @ org.apache.cxf.endpoint.clientimpl.doinvoke(clientimpl.java:532) [cxf-api-2.6.0.jar:2.6.0] @ org.apache.cxf.endpoint.clientimpl.invoke(clientimpl.java:464) [cxf-api-2.6.0.jar:2.6.0] @ org.apache.cxf.endpoint.clientimpl.invoke(clientimpl.java:367) [cxf-api-2.6.0.jar:2.6.0] @ org.apache.cxf.endpoint.clientimpl.invoke(clientimpl.java:320) [cxf-api-2.6.0.jar:2.6.0] @ org.apache.cxf.frontend.clientproxy.invokesync(clientproxy.java:89) [cxf-rt-frontend-simple-2.6.0.jar:2.6.0] @ org.apache.cxf.jaxws.jaxwsclientproxy.invoke(jaxwsclientproxy.java:134) [cxf-rt-frontend-jaxws-2.6.0.jar:2.6.0] ... 5 more caused by: javax.net.ssl.sslhandshakeexception: received fatal alert: handshake_failure @ com.sun.net.ssl.internal.ssl.alerts.getsslexception(alerts.java:174) [jsse.jar:1.6] @ com.sun.net.ssl.internal.ssl.alerts.getsslexception(alerts.java:136) [jsse.jar:1.6] @ com.sun.net.ssl.internal.ssl.sslsocketimpl.recvalert(sslsocketimpl.java:1822) [jsse.jar:1.6] @ com.sun.net.ssl.internal.ssl.sslsocketimpl.readrecord(sslsocketimpl.java:1004) [jsse.jar:1.6] @ com.sun.net.ssl.internal.ssl.sslsocketimpl.performinitialhandshake(sslsocketimpl.java:1188) [jsse.jar:1.6] @ com.sun.net.ssl.internal.ssl.sslsocketimpl.starthandshake(sslsocketimpl.java:1215) [jsse.jar:1.6] @ com.sun.net.ssl.internal.ssl.sslsocketimpl.starthandshake(sslsocketimpl.java:1199) [jsse.jar:1.6] @ sun.net.www.protocol.https.httpsclient.afterconnect(httpsclient.java:434) [jsse.jar:1.6] @ sun.net.www.protocol.https.abstractdelegatehttpsurlconnection.connect(abstractdelegatehttpsurlconnection.java:166) [jsse.jar:1.6] @ sun.net.www.protocol.http.httpurlconnection.getoutputstream(httpurlconnection.java:1014) [classes.jar:1.6.0_45] @ sun.net.www.protocol.https.httpsurlconnectionimpl.getoutputstream(httpsurlconnectionimpl.java:230) [jsse.jar:1.6] @ org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.handleheaderstrustcaching(httpconduit.java:1395) [cxf-rt-transports-http-2.6.0.jar:2.6.0] @ org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.onfirstwrite(httpconduit.java:1337) [cxf-rt-transports-http-2.6.0.jar:2.6.0] @ org.apache.cxf.io.abstractwrappedoutputstream.write(abstractwrappedoutputstream.java:42) [cxf-api-2.6.0.jar:2.6.0] @ org.apache.cxf.io.abstractthresholdoutputstream.write(abstractthresholdoutputstream.java:69) [cxf-api-2.6.0.jar:2.6.0] @ org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.close(httpconduit.java:1415) [cxf-rt-transports-http-2.6.0.jar:2.6.0] ... 15 more
if not doing two-way ssl authentication meaning, server not care client not need check , verify client certificate; in case need on client side trust store contains list of trusted server certificates. in case, client truststore contain self signed server certificate , thats all. usual practice in java have truststore in .jks format. if manage generate truststore set. on server side need not worry truststore need configure server have valid server certificate.
in two-way ssl authentication, need keystore , truststore both configured on both client , server side . client truststore remain same in case of 1-way authentication. server truststore should contain self signed client certificate. both client , server should configured use respective certificates present each othe during ssl handshake. during handshake both parties verify each other's certificate against truststore , establish opposite party's identity. , once identities established should able establish connection.
for generating stores suggest use tool called portecle can quite handy.
Comments
Post a Comment