SSL 握手中止：ssl=0x74d2dc46c8：SSL 库失败，通常是协议错误 OPENSSL_internal:SSLV3_ALERT_HANDSHAKE_FAILURE

Question

在改造中，我在请求中发送 XML，在响应中服务器将发送 XML 作为响应。我正在使用代理来使用该 API。但我总是得到 - HTTP 失败：java.io.IOException：null 上的流意外结束。我已经尝试过 stackoverflow 中提到的解决方案，但没有任何效果。以下代码用于改造客户端 -

    fun getRetrofitClient(context: Context): RestAPI {

    if (mRetrofitClient == null) {

        val cf: CertificateFactory = CertificateFactory.getInstance("X.509")
        val cert: InputStream = context.getResources().openRawResource(R.raw.mycert)
        val ca: Certificate
        ca = try {
            cf.generateCertificate(cert)
        } finally {
            cert.close()
        }

         val keyStoreType: String = KeyStore.getDefaultType()
        val keyStore: KeyStore = KeyStore.getInstance(keyStoreType)
        keyStore.load(null, null)
        keyStore.setCertificateEntry("ca", ca)
        val proxy = Proxy(Proxy.Type.HTTP, InetSocketAddress("xxxx.xx.xx.xx",xxxx ))
        val tmfAlgorithm: String = TrustManagerFactory.getDefaultAlgorithm()
        val tmf: TrustManagerFactory = TrustManagerFactory.getInstance(tmfAlgorithm)
        tmf.init(keyStore)

        val sslContext: SSLContext = SSLContext.getInstance("TLSv1.2")
        sslContext.init(null, tmf.getTrustManagers(), null)

        val spec = ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
            .tlsVersions(TlsVersion.TLS_1_2)
            .cipherSuites(
                CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
            CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
            CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256,
            CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
            CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA,
            CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,
            CipherSuite.TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA,
            CipherSuite.TLS_ECDHE_ECDSA_WITH_RC4_128_SHA,
            CipherSuite.TLS_ECDHE_RSA_WITH_RC4_128_SHA,
            CipherSuite.TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
            CipherSuite.TLS_DHE_DSS_WITH_AES_128_CBC_SHA,
            CipherSuite.TLS_DHE_RSA_WITH_AES_256_CBC_SHA
            )
            .build()


        val httpClient = OkHttpClient.Builder()
            .followRedirects(true)
        .followSslRedirects(true)
        .connectTimeout(10, TimeUnit.MINUTES)
        .readTimeout(10, TimeUnit.MINUTES)
        .writeTimeout(10, TimeUnit.MINUTES)
        .sslSocketFactory(socketFactory)
        .socketFactory(socketFactory)
        .hostnameVerifier(getHostnameVerifier())
        .retryOnConnectionFailure(true)
        .proxy(proxy)
        .connectionSpecs(Collections.singletonList(spec))



        val retrofit = Retrofit.Builder()
            .baseUrl("https://xxx.xx.xx.xx:xxxx/xx/")
            .addConverterFactory(SimpleXmlConverterFactory.create())
            .client(httpClient.build())
            .build()
        mRetrofitClient = retrofit.create(RestAPI::class.java!!)
    }
    return mRetrofitClient!!
}

fun getHostnameVerifier(): HostnameVerifier? {
    return object : HostnameVerifier {
        override fun verify(hostname: String?, session: SSLSession?): Boolean {
            return true
        }
    }
}

以下代码用于 Rest API -

interface RestAPI {
    @Headers("Content-Type: text/xml","Connection: keep-alive","Transfer-Encoding: chunked","Cache-Control: no-cache","Accept: */*","Host: xxx.xx.xx.xx:xxxx","Accept-Encoding: gzip, deflate, br")
    @POST("BillQuery/V1.0")
    abstract fun billQuery(@Body input:String): Call<String>
}

我也试过截击，同样的问题。但它在 Postman 中运行良好。我添加了像邮递员一样的标题。还是不行。

请帮忙。

Answer 1

unexpected end of stream如果无法解析 Response-Headers 或者 Response-Header 中的长度 Content-Length与响应正文的实际长度不匹配，则 okhttp 可能会抛出此异常（请参阅HTTP FAILED: java.io.IOException:意外的流结束异常）在发出 https 请求时）。

在您的情况下，okhttp 希望发送未加密的连接到 HTTP 代理，但在这一步无法从代理响应中解析响应标头（我猜）。代理给 okhttp 一个无效的答案。您可以尝试使用 postman 通过 HTTP 连接到代理吗？