java url hostname,所有信任的HostnameVerifier都会导致HttpURLConnection出现SSL错误

最新推荐文章于 2022-10-11 23:20:00 发布

weixin_39903176

最新推荐文章于 2022-10-11 23:20:00 发布

阅读量508

点赞数

文章标签： java url hostname

I'm using HttpURLConnection to connect to SSL sites. Occasionally these use self signed certificates / otherwise badly behaved SSL so I have a mode where these an be accessed. I'm using the typical code recommended many places online:

// Create a trust manager that does not validate certificate chains

TrustManager[] trustAllCerts = new TrustManager[]{

new X509TrustManager() {

public java.security.cert.X509Certificate[] getAcceptedIssuers() {

return null;

}

public void checkClientTrusted(java.security.cert.X509Certificate[] certs, String authType) {}

public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {}

}

};

// Install the all-trusting trust manager

SSLContext sc = SSLContext.getInstance("SSL");

sc.init(null, trustAllCerts, new java.security.SecureRandom());

HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

// Don't verify host names

HostnameVerifier hv = new HostnameVerifier() {

public boolean verify(String urlHostName, SSLSession session) {

return true;

}

};

HttpsURLConnection.setDefaultHostnameVerifier(hv);

The problem is that this causes SSL errors for many sites, e.g.:

javax.net.ssl.SSLException: Received fatal alert: internal_error

Output when javax.net.debug=all enabled:

[java] Thread-8, READ: TLSv1.2 Alert, length = 2

[java] Thread-8, RECV TLSv1.2 ALERT: fatal, internal_error

[java] Thread-8, called closeSocket()

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

Output when javax.net.debug=all enabled:

[java] Thread-13, READ: TLSv1.2 Alert, length = 2

[java] Thread-13, RECV TLSv1.2 ALERT: fatal, handshake_failure

[java] Thread-13, called closeSocket()

None of these issues are related to the TrustManager, commenting out the HostnameVerifier part always allows the connection to work correctly.

Notes:

Java version: 1.8.0_111

Unfortunately I can't switch to apache httpclient (there's a lot of code built around HttpURLConnection)

解决方案

From jdk 8u66, using a custom HostnameVerifier does not send Extended server_name extension during handshake. This bug will be fixed in version 8u152.

This is the trace of handshake invoking to https://www.territrespicio.com with your code

*** ClientHello, TLSv1.2

RandomCookie: GMT: 1467981635 bytes = { 253, 197, 8, 192, 170, 180, 230, 6, 212, 233, 219, 201, 182, 39, 204, 176, 49, 215, 43, 41, 112, 204, 188, 29, 115, 235, 191, 74 }

Session ID: {}

Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]

Compression Methods: { 0 }

Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}

Extension ec_point_formats, formats: [uncompressed]

Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA

***

main, WRITE: TLSv1.2 Handshake, length = 233

main, READ: TLSv1.2 Alert, length = 2

main, RECV TLSv1.2 ALERT: fatal, handshake_failure

main, called closeSocket()

main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

Exception in thread "main" javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

This is the trace (working) removing

HttpsURLConnection.setDefaultHostnameVerifier(hv);

*** ClientHello, TLSv1.2

RandomCookie: GMT: 1467981305 bytes = { 187, 36, 131, 239, 148, 148, 198, 107, 89, 74, 67, 33, 127, 76, 24, 17, 108, 254, 79, 104, 242, 239, 51, 36, 180, 244, 181, 45 }

Session ID: {}

Compression Methods: { 0 }

Extension ec_point_formats, formats: [uncompressed]

Extension server_name, server_name: [type=host_name (0), value=www.territrespicio.com]

***

main, WRITE: TLSv1.2 Handshake, length = 264

main, READ: TLSv1.2 Handshake, length = 89

*** ServerHello, TLSv1.2

RandomCookie: GMT: -2137263708 bytes = { 105, 47, 249, 171, 64, 55, 195, 235, 198, 159, 46, 193, 42, 65, 156, 243, 134, 177, 35, 221, 75, 16, 222, 103, 42, 55, 103, 231 }

Session ID: {42, 151, 108, 66, 43, 195, 53, 201, 234, 24, 245, 14, 183, 242, 185, 128, 66, 115, 60, 35, 167, 159, 178, 238, 93, 155, 20, 195, 95, 155, 11, 79}

Cipher Suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384

Compression Method: 0

Extension renegotiation_info, renegotiated_connection:

Extension ec_point_formats, formats: [uncompressed, ansiX962_compressed_prime, ansiX962_compressed_char2]

***

You can see that adds in ClientHello the required extension

Extension server_name, server_name: [type=host_name (0), value=www.territrespicio.com]

There is no documented workaround. So consider using a JDK version <8u66 or >=8u152

Updated -- Workaround

If you use a custom SSLSocketFactory without override createSocket() (the method without parameters), the createSocket well parametrized is used and all works as expected (with client sni extension).

You can find a similar workaround here. I have tried with just a wrapper and it works.

HttpsURLConnection.setDefaultSSLSocketFactory(

new SSLSocketFactoryWrapper(sc.getSocketFactory()));

SSLSocketFactoryWrapper (full code)

package test;

import java.io.IOException;

import java.net.InetAddress;

import java.net.Socket;

import java.net.UnknownHostException;

import javax.net.ssl.SSLSocketFactory;

public class SSLSocketFactoryWrapper extends SSLSocketFactory {

private SSLSocketFactory factory;

public SSLSocketFactoryWrapper(SSLSocketFactory factory){

this.factory = factory;

}

@Override

public Socket createSocket() throws IOException {

return factory.createSocket();

}

@Override

public Socket createSocket(Socket s, String host, int port, boolean autoClose) throws IOException {

return factory.createSocket(s, host, port, autoClose);

}

@Override

public String[] getDefaultCipherSuites() {

return factory.getDefaultCipherSuites();

}

@Override

public String[] getSupportedCipherSuites() {

return factory.getSupportedCipherSuites();

}

@Override

public Socket createSocket(String host, int port) throws IOException, UnknownHostException {

return factory.createSocket(host, port);

}

@Override

public Socket createSocket(InetAddress host, int port) throws IOException {

return factory.createSocket(host, port);

}

@Override

public Socket createSocket(String host, int port, InetAddress localHost, int localPort)

throws IOException, UnknownHostException {

return factory.createSocket(host, port, localHost, localPort);

}

@Override

public Socket createSocket(InetAddress address, int port, InetAddress localAddress, int localPort) throws IOException {

return factory.createSocket(address, port, localAddress, localPort);

}

weixin_39903176

关注

0
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
java url hostname,所有信任的HostnameVerifier都会导致HttpURLConnection出现SSL错误

I'm using HttpURLConnection to connect to SSL sites. Occasionally these use self signed certificates / otherwise badly behaved SSL so I have a mode where these an be accessed. I'm using the typical co...
复制链接

扫一扫