Java 8, JCE illimitato politica Forza e SSL Stretta di mano sopra TLS

Question

con Java 8, server che supporta solo TLSv1, non riesce a fare il collegamento secure socket da cento OS

Versione

java version "1.8.0_45" 
Java(TM) SE Runtime Environment (build 1.8.0_45-b14) 
Java HotSpot(TM) 64-Bit Server VM (build 25.45-b02, mixed mode) 

fonte

import javax.net.ssl.SSLSession; 
import javax.net.ssl.SSLSocket; 
import javax.net.ssl.SSLSocketFactory; 
import java.io.BufferedReader; 
import java.io.IOException; 
import java.io.InputStreamReader; 

/** 
* Created by jigar.joshi on 6/10/15. 
*/ 
public class SSLTester { 
    public static void main(String[] args) throws Exception { 
     SSLSocketFactory f = 
       (SSLSocketFactory) SSLSocketFactory.getDefault(); 
     SSLSocket socket = (SSLSocket) f.createSocket("efm.sandbox.vovici.com", 443); 
     try { 
      printSocketInfo(socket); 
      socket.startHandshake();  
      System.out.println("----------------------------------SUCCESS----------------------------------"); 

      BufferedReader r = new BufferedReader(
        new InputStreamReader(socket.getInputStream())); 
      String m = null; 
      while ((m = r.readLine()) != null) { 
       System.out.println(m); 

      } 
      r.close(); 
      socket.close(); 
     } catch (IOException e) { 
      e.printStackTrace(); 
      System.err.println(e.toString()); 
     } 
    } 

    private static void printSocketInfo(SSLSocket s) { 
     System.out.println("Socket class: " + s.getClass()); 
     System.out.println(" Remote address = " 
       + s.getInetAddress().toString()); 
     System.out.println(" Remote port = " + s.getPort()); 
     System.out.println(" Local socket address = " 
       + s.getLocalSocketAddress().toString()); 
     System.out.println(" Local address = " 
       + s.getLocalAddress().toString()); 
     System.out.println(" Local port = " + s.getLocalPort()); 
     System.out.println(" Need client authentication = " 
       + s.getNeedClientAuth()); 
     SSLSession ss = s.getSession(); 
     System.out.println(" Cipher suite = " + ss.getCipherSuite()); 
     System.out.println(" Protocol = " + ss.getProtocol()); 
    } 

} 

con la stessa versione di JVM, fa han dshake con successo su OSX, non riesce su CentOS, causa del disturbo è solo tenta di utilizzare TLSv1.2 (impostazione predefinita in JVM 8) e non cerca il protocollo inferiore

note di debug:

-Ddeployment.security.TLSv1.0=true 

-Ddeployment.security.TLSv1=true 

-Ddeployment.security.TLSv1.1=false 

-Ddeployment.security.TLSv1.2=false 

-Djavax.net.debug=ssl:handshake:verbose 

Domanda:

• Perché è in grado di scegliere TLSv1 su OSX e non su CentOS?

• Come posso dire a JVM per utilizzare i protocolli in ordine specifico o se ritiene ordine dalla versione allora come faccio a dirgli di provare anche con v1

Edit:

Ho un numero illimitato di politiche JCE di forza installate con JRE che sta causando questo, funziona senza che la differenza di OSX e CentOS sia sparita, come posso farlo funzionare?

Edit:

uscita

Socket class: class sun.security.ssl.SSLSocketImpl 
    Remote address = efm.sandbox.vovici.com/206.132.29.15 
    Remote port = 443 
    Local socket address = /10.10.152.143:50376 
    Local address = /10.10.152.143 
    Local port = 50376 
    Need client authentication = false 
    Cipher suite = SSL_NULL_WITH_NULL_NULL 
    Protocol = NONE 
javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake 
    at sun.security.ssl.SSLSocketImpl.checkEOF(SSLSocketImpl.java:1529) 
    at sun.security.ssl.SSLSocketImpl.checkWrite(SSLSocketImpl.java:1541) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1375) 
    at SSLTester.main(SSLTester.java:24) 
Caused by: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake 
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:980) 
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1363) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1391) 
    at sun.security.ssl.SSLSocketImpl.getSession(SSLSocketImpl.java:2225) 
    at SSLTester.printSocketInfo(SSLTester.java:56) 
    at SSLTester.main(SSLTester.java:23) 
Caused by: java.io.EOFException: SSL peer shut down incorrectly 
    at sun.security.ssl.InputRecord.read(InputRecord.java:505) 
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:961) 
    ... 5 more 
javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake 

Answer 1

provare a limitare i protocolli da solo TLSv1 utilizzando:

-Djdk.tls.client.protocols=TLSv1 

Vai a questa pagina per maggiori dettagli: https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#descPhase2

Speranza THI s aiuta,

Yuri