tomcat 7 + ssl无法正常工作 - ERR_SSL_VERSION_OR_CIPHER_MISMATCH

Question

Ubuntu 14,tomcat 7,java 7

godaddy提供的our.crt,our.key和gd_bundle-g2-g1.crt.该捆绑包中有3个证书(通过vi'ing文件看到).

注意,我们的key和crt在node.js上使用没有问题.

我们从现有的crt创建了一个密钥库:

cd /etc/ssl
openssl pkcs12 -export -in our.crt -inkey our.key -out our.p12 -name tomcat -CAfile gd_bundle-g2-g1.crt -caname root -chain

server.xml是这样的:

<Server port="8005" shutdown="SHUTDOWN">

<Listener className="org.apache.catalina.core.JasperListener" />
<Listener className="org.apache.catalina.core.JreMemoryLeakPreventionListener" />
<Listener className="org.apache.catalina.mbeans.GlobalResourcesLifecycleListener" />
<Listener className="org.apache.catalina.core.ThreadLocalLeakPreventionListener" />



<GlobalNamingResources>
<Resource name="UserDatabase" auth="Container"
          type="org.apache.catalina.UserDatabase"
          description="User database that can be updated and saved"
          factory="org.apache.catalina.users.MemoryUserDatabaseFactory"
          pathname="conf/tomcat-users.xml" />
</GlobalNamingResources>


<Service name="Catalina">

<Connector port="80" protocol="HTTP/1.1"
           connectionTimeout="20000"
           URIEncoding="UTF-8"
           redirectPort="8443" />

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
           maxThreads="200" scheme="https" secure="true"
           keystoreType="PKCS12"
           keystoreFile="/etc/ssl/our.p12" keystorePass=""
           clientAuth="false" sslProtocol="TLS" />

• Tomcat启动时没有错误.
• webapp在端口80上正常工作.
• 服务器没有运行fw.

我们设置了从443到8443的本地重定向:

iptables -t nat -A PREROUTING -p tcp --dport 443 -j REDIRECT --to-port 8443

然后尝试https://www.ourserver.com/ourapp

Chrome提供:ERR_SSL_VERSION_OR_CIPHER_MISMATCH

在本地计算机上运行的curl示例:

curl -Iv https://www.ourserver.com:8443
* Rebuilt URL to: https://www.ourserver.com:8443/
* Hostname was NOT found in DNS cache
*   Trying 1xxxxxxxx...
* Connected to www.ourserver.com (1xxxx) port 8443 (#0)
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS alert, Server hello (2):
* error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:14077410:SSL routines:SSL23_GET_SERVER_HELLO:sslv3 alert handshake failure

有任何想法吗？

更新1

我尝试在新服务器上设置一个新的tomcat 7,并安装了一份新的证书副本,并得到了同样的错误.

Answer 1

尝试将ciphers属性添加到连接器标记中

ciphers="TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
   TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_RC4_128_SHA,
   TLS_RSA_WITH_AES_128_CBC_SHA256,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA256,
   TLS_RSA_WITH_AES_256_CBC_SHA,SSL_RSA_WITH_RC4_128_SHA"

如果没有帮助,请尝试将协议属性更改protocol="HTTP/1.1"为protocol="org.apache.coyote.http11.Http11Protocol"

有关更多参考,请参阅