仅在生产服务器上出现 Java HttpClient SSL 握手异常

Question

似乎有很多关于类似问题的帖子，但我找不到任何对我有用的帖子。

我在 Java 7 中有代码使用 HttpClient 4.3.5 来获取特定的 url。当我通过 mvn 测试在本地运行或部署到 tomcat 服务器时，此代码有效，但在生产服务器上的 tomcat 中运行时失败并出现 SSL 握手异常。我将在下面包含正在使用的代码(请忽略 httpclient 的某些设置方式是完全不安全的，它旨在处理任何站点和证书，即使它设置不正确)和 -Djavax 的错误堆栈跟踪。 net.debug=all 包含在 tomcat 运行时中以获取额外的日志记录详细信息。我已经实现了 Java Cryptography Unlimited Strength Jurisdiction Policy Extension 并且还添加了 bouncy caSTLe，使我的代码适用于大多数站点。目前它似乎适用于几乎所有这些，除了一个站点，它只在生产服务器上出错但在本地对我来说工作正常。

我的代码:

Security.insertProviderAt(new BouncyCastleProvider(), 1);
KeyStore trustStore  = KeyStore.getInstance(KeyStore.getDefaultType());
SSLContextBuilder sslBuilder = new SSLContextBuilder();
sslBuilder.loadTrustMaterial(trustStore, new TrustStrategy() {
   @Override
   public boolean isTrusted(X509Certificate[] x509Certificates, String s) throws CertificateException {
      return true;
   }
});

SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslBuilder.build(), new String[] { "TLSv1.2", "TLSv1.1", "TLSv1", "SSLv3"}, null, SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
PlainConnectionSocketFactory pcsf = new PlainConnectionSocketFactory();
Registry socketFactoryRegistry = RegistryBuilder.create().register("https", sslsf).register("http", pcsf).build();
multiConnectionManager = new PoolingHttpClientConnectionManager(socketFactoryRegistry);
multiConnectionManager.setMaxTotal(100);
multiConnectionManager.setDefaultMaxPerRoute(10);
httpClientBuilder.setConnectionManager(multiConnectionManager);
this.httpClient = httpClientBuilder.disableContentCompression().setSSLSocketFactory(sslsf).build();

HttpGet call = new HttpGet(url);
HttpResponse getResponse;
   try {
      call.addHeader("User-Agent","Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.0)");
      call.addHeader("Accept","text/html");
      call.setConfig(RequestConfig.custom().setCircularRedirectsAllowed(true).setMaxRedirects(5).setCookieSpec(CookieSpecs.IGNORE_COOKIES).build());
         try {
            getResponse = httpClient.execute(call);
         } 
         catch (Exception ex) {}
   } 
   catch (Exception ex) {}

堆栈跟踪:

trigger seeding of SecureRandom
done seeding SecureRandom
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring disabled protocol: SSLv3
%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1470874697 bytes = { 159, 94, 240, 233, 124, 91, 106, 83, 249, 126, 156, 56, 200, 67, 114, 18, 205, 36, 55, 140, 229, 223, 66, 190, 204, 226, 223, 90 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA224withECDSA, SHA224withRSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA, MD5withRSA
***
[write] MD5 and SHA1 hashes:  len = 181
0000: 01 00 00 B1 03 03 58 AC   C4 49 9F 5E F0 E9 7C 5B  ......X..I.^...[
0010: 6A 53 F9 7E 9C 38 C8 43   72 12 CD 24 37 8C E5 DF  jS...8.Cr..$7...
0020: 42 BE CC E2 DF 5A 00 00   2C C0 0A C0 14 00 35 C0  B....Z..,.....5.
0030: 05 C0 0F 00 39 00 38 C0   09 C0 13 00 2F C0 04 C0  ....9.8...../...
0040: 0E 00 33 00 32 C0 08 C0   12 00 0A C0 03 C0 0D 00  ..3.2...........
0050: 16 00 13 00 FF 01 00 00   5C 00 0A 00 34 00 32 00  ........\...4.2.
0060: 17 00 01 00 03 00 13 00   15 00 06 00 07 00 09 00  ................
0070: 0A 00 18 00 0B 00 0C 00   19 00 0D 00 0E 00 0F 00  ................
0080: 10 00 11 00 02 00 12 00   04 00 05 00 14 00 08 00  ................
0090: 16 00 0B 00 02 01 00 00   0D 00 1A 00 18 06 03 06  ................
00A0: 01 05 03 05 01 04 03 04   01 03 03 03 01 02 03 02  ................
00B0: 01 02 02 01 01                                     .....
ActiveMQ Session Task-2, WRITE: TLSv1.2 Handshake, length = 181
[Raw write]: length = 186
0000: 16 03 03 00 B5 01 00 00   B1 03 03 58 AC C4 49 9F  ...........X..I.
0010: 5E F0 E9 7C 5B 6A 53 F9   7E 9C 38 C8 43 72 12 CD  ^...[jS...8.Cr..
0020: 24 37 8C E5 DF 42 BE CC   E2 DF 5A 00 00 2C C0 0A  $7...B....Z..,..
0030: C0 14 00 35 C0 05 C0 0F   00 39 00 38 C0 09 C0 13  ...5.....9.8....
0040: 00 2F C0 04 C0 0E 00 33   00 32 C0 08 C0 12 00 0A  ./.....3.2......
0050: C0 03 C0 0D 00 16 00 13   00 FF 01 00 00 5C 00 0A  .............\..
0060: 00 34 00 32 00 17 00 01   00 03 00 13 00 15 00 06  .4.2............
0070: 00 07 00 09 00 0A 00 18   00 0B 00 0C 00 19 00 0D  ................
0080: 00 0E 00 0F 00 10 00 11   00 02 00 12 00 04 00 05  ................
0090: 00 14 00 08 00 16 00 0B   00 02 01 00 00 0D 00 1A  ................
00A0: 00 18 06 03 06 01 05 03   05 01 04 03 04 01 03 03  ................
00B0: 03 01 02 03 02 01 02 02   01 01                    ..........
[Raw read]: length = 5
0000: 15 03 03 00 02                                     .....
[Raw read]: length = 2
0000: 02 28                                              .(
ActiveMQ Session Task-2, READ: TLSv1.2 Alert, length = 2
ActiveMQ Session Task-2, RECV TLSv1 ALERT:  fatal, handshake_failure
ActiveMQ Session Task-2, called closeSocket()
ActiveMQ Session Task-2, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

有人可以提供任何帮助来解决为什么会发生此握手错误以及为什么它只发生在生产服务器上(通过 tomcat 运行 java 代码的 linux 机器)并且在本地对我来说工作正常(mac 通过 mvn 运行单元测试或通过 tomcat 的 java 代码)将是最有帮助的。

Answer 1

好吧，终于明白了。我完全相信 dave_thompson_085 为我指明了正确的方向。这是一个 SNI 问题。

事实证明，自从我使用 HttpClient 4.3.5 以来，SNI 在我的本地环境和测试中默认启用，但在 tomcat 中，它要么引入了一个旧库，要么设置了一些其他配置，这导致它在生产服务器中被禁用。因此只需设置系统属性:

System.setProperty("jsse.enableSNIExtension", "true");

在代码中加载 HttpClient 库然后重新部署到生产服务器上的 tomcat 之前完全解决了这个问题。