漏洞修复引发的项目报错

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

由于安全组进行漏洞修复，升级了TLS版本，但是项目没有跟着升级，于是得到了如下报错：

HTTP Status 500 -
type Exception report

message

description The server encountered an internal error () that prevented it from fulfilling this request.

exception

java.lang.RuntimeException: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:443)
    org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:41)
    org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:190)
    org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:241)
    com.yd.cas.client.authentication.VirtualFilterChain.doFilter(YDSSOFilter.java:164)
    com.yd.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:182)
    com.yd.cas.client.authentication.VirtualFilterChain.doFilter(YDSSOFilter.java:164)
    com.yd.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:119)
    com.yd.cas.client.authentication.VirtualFilterChain.doFilter(YDSSOFilter.java:164)
    com.yd.cas.client.authentication.YDSSOFilter.doFilter(YDSSOFilter.java:60)
    org.springframework.session.web.http.SessionRepositoryFilter.doFilterInternal(SessionRepositoryFilter.java:171)
    org.springframework.session.web.http.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:80)
    org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
    org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
root cause

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
    sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1959)
    sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1077)
    sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
    sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
    sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
    sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
    sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1300)
    sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254)
    org.jasig.cas.client.util.CommonUtils.getResponseFromServer(CommonUtils.java:429)
    org.jasig.cas.client.validation.AbstractCasProtocolUrlBasedTicketValidator.retrieveResponseFromServer(AbstractCasProtocolUrlBasedTicketValidator.java:41)
    org.jasig.cas.client.validation.AbstractUrlBasedTicketValidator.validate(AbstractUrlBasedTicketValidator.java:190)
    org.jasig.cas.client.validation.AbstractTicketValidationFilter.doFilter(AbstractTicketValidationFilter.java:241)
    com.yd.cas.client.authentication.VirtualFilterChain.doFilter(YDSSOFilter.java:164)
    com.yd.cas.client.authentication.AuthenticationFilter.doFilter(AuthenticationFilter.java:182)
    com.yd.cas.client.authentication.VirtualFilterChain.doFilter(YDSSOFilter.java:164)
    com.yd.cas.client.session.SingleSignOutFilter.doFilter(SingleSignOutFilter.java:119)
    com.yd.cas.client.authentication.VirtualFilterChain.doFilter(YDSSOFilter.java:164)
    com.yd.cas.client.authentication.YDSSOFilter.doFilter(YDSSOFilter.java:60)
    org.springframework.session.web.http.SessionRepositoryFilter.doFilterInternal(SessionRepositoryFilter.java:171)
    org.springframework.session.web.http.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:80)
    org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)
    org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:259)
note The full stack trace of the root cause is available in the Apache Tomcat/7.0.5 logs.

解决方案：

1.设置JVM参数如下，提高客户端的TLS版本

-Dhttps.protocols=TLSv1.2

2. 更换jdk中jce的jar包

网上资料说这个应该是旧版本jdkjce中安全机制的bug，要去oracle官网下载对应的jce包替换jdk中的jce包

jce所在jdk的路径： %JAVA_HOME%\jre\lib\security里的local_policy.jar,US_export_policy.jar

JDK7 http://www.oracle.com/technetwork/java/javase/downloads/jce-7-download-432124.html

JDK8 http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html

百度网盘：

链接：https://pan.baidu.com/s/1uYy1BSCM-2j5DGUoqzGoMQ

提取码：8fyb

复制这段内容后打开百度网盘手机App，操作更方便哦

3.升级 JDK到1.8版本