java 输出ssl握手信息_java – HttpClient：每个请求都有ssl握手

我使用静态HttpClient,它在https上工作得非常慢.我添加了-D

javax.net.debug = ssl,发现每次https请求都会再次启动握手.

看起来它无法重用旧会话,但我找不到原因.

9007199254743735, setSoTimeout(0) called

Allow unsafe renegotiation: false

Allow legacy hello messages: true

Is initial handshake: true

Is secure renegotiation: false

9007199254743735, setSoTimeout(0) called

%% No cached client session

*** ClientHello, SSLv3

...

%% Didn't cache non-resumable client session: [Session-1, SSL_RSA_WITH_RC4_128_MD5]

...

Is initial handshake: true

BTW.在我遇到此主机上的另一个问题之前：“收到致命警报：bad_record_mac”,它只通过允许SSLv3解决

UPD1：HttpClient初始化代码

final SSLContext sslCtx;

sslCtx = SSLContext.getInstance("SSL");

sslCtx.init(null, new TrustManager[]{new X509TrustManager() {

@Override

public void checkClientTrusted(X509Certificate[] cert,

String authType) {

}

@Override

public void checkServerTrusted(X509Certificate[] cert,

String authType) {

}

@Override

public X509Certificate[] getAcceptedIssuers() {

return null;

}

}}, null);

X509HostnameVerifier verifier = new X509HostnameVerifier() {

@Override

public void verify(String string, SSLSocket ssls) throws IOException {

}

@Override

public void verify(String string, X509Certificate xc) throws SSLException {

}

@Override

public void verify(String string, String[] strings, String[] strings1) throws SSLException {

}

@Override

public boolean verify(String string, SSLSession ssls) {

return true;

}

};

final SSLSocketFactory socketFactory = new SSLv3SocketFactory(sslCtx, verifier);

final SchemeRegistry registry = new SchemeRegistry();

registry.register(new Scheme("https", 443, socketFactory));

final PoolingClientConnectionManager cm = new PoolingClientConnectionManager(registry);

cm.setMaxTotal(100);

cm.setDefaultMaxPerRoute(50);

final HttpParams httpParams = new BasicHttpParams();

HttpConnectionParams.setSoTimeout(httpParams, timeout);

httpClient = new DefaultHttpClient(cm, httpParams);

((DefaultHttpClient) httpClient).setKeepAliveStrategy(new ConnectionKeepAliveStrategy() {

@Override

public long getKeepAliveDuration(HttpResponse hr, HttpContext hc) {

return 0;

}

});

httpClient.getParams().setParameter("http.socket.timeout", 900000);

UPD2：修改后的SSLSocketFactory(“收到致命警报：bad_record_mac”问题)

public class SSLv3SocketFactory extends SSLSocketFactory {

private final javax.net.ssl.SSLSocketFactory socketfactory;

public SSLv3SocketFactory(SSLContext sslContext, X509HostnameVerifier hostnameVerifier) {

super(sslContext, hostnameVerifier);

this.socketfactory = sslContext.getSocketFactory();

}

@Override

public Socket createLayeredSocket(

final Socket socket,

final String host,

final int port,

final boolean autoClose) throws IOException, UnknownHostException {

SSLSocket sslSocket = (SSLSocket) this.socketfactory.createSocket(

socket,

host,

port,

autoClose);

sslSocket.setEnabledProtocols(new String[]{"SSLv3"});

return sslSocket;

}

@Override

public Socket connectSocket(

final Socket socket,

final InetSocketAddress remoteAddress,

final InetSocketAddress localAddress,

final HttpParams params) throws IOException, UnknownHostException, ConnectTimeoutException {

if (socket instanceof SSLSocket) {

((SSLSocket) socket).setEnabledProtocols(new String[]{"SSLv3"});;

}

return super.connectSocket(socket, remoteAddress, localAddress, params);

}

}

UPD3：问题仅存在于SSLv3,TLSv1正常工作

最佳答案 HttpClient只有在确保它们属于相同的用户/安全上下文时才会重新使用持久性SSL连接和客户端身份验证(出于显而易见的原因).

确保您对所有逻辑相关的请求使用相同的HttpContext.这将确保安全主体(客户端证书的DN)将在各个HTTP请求之间传播.

跟进

它调整了服务器根本不希望重新使用连接.每个响应都包含“Connection：close”指令,该指令在收到响应后提示客户端关闭连接.但是,可能会发生这样的情况：服务器根据请求消息组成以不同方式处理不同的客户端.尝试使用不同的User-Agent标头值伪装HttpClient,看看是否有任何区别.