Websphere 8.5 上的 SSL 握手失败（在 Tomcat 上工作）

Question

Websphere 8.5 上的 SSL 握手失败（在 Tomcat 上工作）

长话短说; Tomcat 上运行的应用程序无法与 Paypal 服务器通信有什么原因吗？一些背景：我们正在 Liferay 上开发一系列 portlet，这些 portlet 在某些时候与 paypal 服务器通信以启动和验证购买流程。这就像本地 tomcat 上的 charm 一样，无需任何特殊配置，但在安装 Liferay 和 portlet 后，它无法启动该进程。堆栈看起来像这样：

[16/12/14 13:51:01:728 GMT+01:00] 0000015d SystemOut     O 13:51:01,727 ERROR [WebContainer : 2][render_portlet_jsp:132] null
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at com.ibm.jsse2.o.a(o.java:33)
    at com.ibm.jsse2.o.a(o.java:30)
    at com.ibm.jsse2.SSLSocketImpl.b(SSLSocketImpl.java:168)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:318)
    at com.ibm.jsse2.SSLSocketImpl.h(SSLSocketImpl.java:403)
    at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:431)
    at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:315)
    at com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:103)
    at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:42)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1184)
    at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:390)
    at com.ibm.net.ssl.www2.protocol.https.b.getResponseCode(b.java:82)
    at com.paypal.core.HttpConnection.execute(HttpConnection.java:93)
    at com.paypal.core.APIService.makeRequestUsing(APIService.java:176)
    at com.paypal.core.BaseService.call(BaseService.java:265)
    at urn.ebay.api.PayPalAPI.PayPalAPIInterfaceServiceService.setExpressCheckout(PayPalAPIInterfaceServiceService.java:2196)
    at urn.ebay.api.PayPalAPI.PayPalAPIInterfaceServiceService.setExpressCheckout(PayPalAPIInterfaceServiceService.java:2148)

Run Code Online (Sandbox Code Playgroud)

我已经“谷歌搜索”了一下，但无法弄清楚错误可能出在哪里。我们尝试注册从 Paypal 网站检索到的 Verisign 证书的签名者，但没有任何改变。

有人可以为我们指明正确的方向吗？谢谢！

更新提高网络日志记录级别后，我可以在日志中看到以下内容：

     O class com.ibm.websphere.ssl.protocol.SSLSocketFactory is loaded
     O instantiated an instance of class com.ibm.websphere.ssl.protocol.SSLSocketFactory
     O 
handshake: true
     O Ignoring unsupported cipher suite: SSL_RSA_WITH_AES_128_CBC_SHA
     O Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_128_CBC_SHA
     O Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_128_CBC_SHA
     O %% No cached client session
     O *** ClientHello, SSLv3
     O RandomCookie:  GMT: 1402031796 bytes = { 166, 100, 171, 183, 214, 31, 12, 68, 124, 68, 151, 195, 7, 4, 28, 112, 39, 90, 248, 143, 129, 106, 212, 33, 244, 40, 233, 94 }
     O Session ID:  {}
     O Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_RC4_128_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RENEGO_PROTECTION_REQUEST]
     O Compression Methods:  { 0 }
     O ***
     O [write] MD5 and SHA1 hashes:  len = 75
     O 0000: 01 00 00 47 03 00 54 91  4f b4 a6 64 ab b7 d6 1f  ...G..T.O..d....
0010: 0c 44 7c 44 97 c3 07 04  1c 70 27 5a f8 8f 81 6a  .D.D.....p.Z...j
0020: d4 21 f4 28 e9 5e 00 00  20 00 04 00 05 00 0a fe  ................
0030: ff 00 16 00 13 00 66 00  09 fe fe 00 15 00 12 00  ......f.........
0040: 03 00 08 00 14 00 11 00  ff 01 00                 ...........

     O WebContainer : 10, WRITE: SSLv3 Handshake, length = 75
     O [Raw write]: length = 80
     O 0000: 16 03 00 00 4b 01 00 00  47 03 00 54 91 4f b4 a6  ....K...G..T.O..
0010: 64 ab b7 d6 1f 0c 44 7c  44 97 c3 07 04 1c 70 27  d.....D.D.....p.
0020: 5a f8 8f 81 6a d4 21 f4  28 e9 5e 00 00 20 00 04  Z...j...........
0030: 00 05 00 0a fe ff 00 16  00 13 00 66 00 09 fe fe  ...........f....
0040: 00 15 00 12 00 03 00 08  00 14 00 11 00 ff 01 00  ................

     O [Raw read]: length = 5
     O 0000: 15 03 00 00 02                                     .....

     O [Raw read]: length = 2
     O 0000: 02 28                                              ..

     O WebContainer : 10, READ: SSLv3 Alert, length = 2
     O WebContainer : 10, RECV TLSv1 ALERT:  fatal, handshake_failure
     O WebContainer : 10, called closeSocket()
     O WebContainer : 10, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
     O 
handshake: true
     O Ignoring unsupported cipher suite: SSL_RSA_WITH_AES_128_CBC_SHA
     O Ignoring unsupported cipher suite: SSL_DHE_RSA_WITH_AES_128_CBC_SHA
     O Ignoring unsupported cipher suite: SSL_DHE_DSS_WITH_AES_128_CBC_SHA
     O %% No cached client session
     O *** ClientHello, SSLv3
     O RandomCookie:  GMT: 1402031797 bytes = { 153, 95, 153, 155, 68, 36, 152, 92, 71, 172, 226, 104, 156, 107, 235, 73, 63, 239, 198, 202, 166, 216, 158, 26, 45, 59, 169, 169 }
     O Session ID:  {}
     O Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_RC4_128_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_RSA_FIPS_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RENEGO_PROTECTION_REQUEST]
     O Compression Methods:  { 0 }
     O ***
     O [write] MD5 and SHA1 hashes:  len = 75
     O 0000: 01 00 00 47 03 00 54 91  4f b5 99 5f 99 9b 44 24  ...G..T.O.....D.
0010: 98 5c 47 ac e2 68 9c 6b  eb 49 3f ef c6 ca a6 d8  ..G..h.k.I......
0020: 9e 1a 2d 3b a9 a9 00 00  20 00 04 00 05 00 0a fe  ................
0030: ff 00 16 00 13 00 66 00  09 fe fe 00 15 00 12 00  ......f.........
0040: 03 00 08 00 14 00 11 00  ff 01 00                 ...........

     O WebContainer : 10, WRITE: SSLv3 Handshake, length = 75
     O [Raw write]: length = 80
     O 0000: 16 03 00 00 4b 01 00 00  47 03 00 54 91 4f b5 99  ....K...G..T.O..
0010: 5f 99 9b 44 24 98 5c 47  ac e2 68 9c 6b eb 49 3f  ...D...G..h.k.I.
0020: ef c6 ca a6 d8 9e 1a 2d  3b a9 a9 00 00 20 00 04  ................
0030: 00 05 00 0a fe ff 00 16  00 13 00 66 00 09 fe fe  ...........f....
0040: 00 15 00 12 00 03 00 08  00 14 00 11 00 ff 01 00  ................

     O [Raw read]: length = 5
     O 0000: 15 03 00 00 02                                     .....

     O [Raw read]: length = 2
     O 0000: 02 28                                              ..

     O WebContainer : 10, READ: SSLv3 Alert, length = 2
     O WebContainer : 10, RECV TLSv1 ALERT:  fatal, handshake_failure
     O WebContainer : 10, called closeSocket()
     O WebContainer : 10, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
     O 10:41:09,593 ERROR [WebContainer : 10][PaypalUtils:145] Errores en setPaypalExpressCheckout
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at com.ibm.jsse2.o.a(o.java:33)
    at com.ibm.jsse2.o.a(o.java:30)

Run Code Online (Sandbox Code Playgroud)

服务器控制台中配置的SSL协议是TLS。

Answer 1

Ste*_*ich 0

收到致命警报：handshake_failure

这可以是任何事情，比如缺少客户端证书、没有共享密码、错误的协议版本等。但它通常与证书验证无关。

请与其他客户、SSLLabs 等核实，以减少可能原因的数量。另请参阅http://noxxi.de/howto/ssl-debugging.html#aid_external_debugging，了解您在调试中可能尝试的步骤以及在需要其他人的帮助时应收集哪些信息。如果您有更多信息，请在此处发布，以便人们有望找到解决您问题的方法。

根据问题中的新信息进行编辑：

 O *** ClientHello, SSLv3
 ...
 O 0000: 16 03 00

Run Code Online (Sandbox Code Playgroud)

您正在使用 SSL 3.0，这可以从调试消息中看出。由于 POODLE，SSL 3.0 被大多数主要站点阻止。虽然您声称已经使用 TLS1.x，但根据这些调试信息，情况似乎并非如此，因此您应该再次检查您的设置。

归档时间：	10 年，10 月前
查看次数：	12174 次
最近记录：	1 年，10 月前