javax.net.ssl.SSLException：收到致命警报：protocol_version

问题描述：

有没有人遇到过此错误？我是SSL新手，我的ClientHello有什么明显错误，我错过了？该异常是在没有ServerHello响应的情况下抛出的。任何建议表示赞赏。javax.net.ssl.SSLException：收到致命警报：protocol_version

*** ClientHello, TLSv1 
RandomCookie: GMT: 1351745496 bytes = { 154, 151, 225, 128, 127, 137, 198, 245, 160, 35, 124, 13, 135, 120, 33, 240, 82, 223, 56, 25, 207, 231, 231, 124, 103, 205, 66, 218 } 
Session ID: {} 
Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] 
Compression Methods: { 0 } 
*** 
[write] MD5 and SHA1 hashes: len = 75 
0000: 01 00 00 47 03 01 51 92 00 D8 9A 97 E1 80 7F 89 ...G..Q......... 
0010: C6 F5 A0 23 7C 0D 87 78 21 F0 52 DF 38 19 CF E7 ...#...x!.R.8... 
0020: E7 7C 67 CD 42 DA 00 00 20 00 04 00 05 00 2F 00 ..g.B... ...../. 
0030: 33 00 32 00 0A 00 16 00 13 00 09 00 15 00 12 00 3.2............. 
0040: 03 00 08 00 14 00 11 00 FF 01 00     ........... 
xxx, WRITE: TLSv1 Handshake, length = 75 
[write] MD5 and SHA1 hashes: len = 101 
0000: 01 03 01 00 3C 00 00 00 20 00 00 04 01 00 80 00 ....<... ....... 
0010: 00 05 00 00 2F 00 00 33 00 00 32 00 00 0A 07 00 ..../..3..2..... 
0020: C0 00 00 16 00 00 13 00 00 09 06 00 40 00 00 15 [email protected] 
0030: 00 00 12 00 00 03 02 00 80 00 00 08 00 00 14 00 ................ 
0040: 00 11 00 00 FF 51 92 00 D8 9A 97 E1 80 7F 89 C6 .....Q.......... 
0050: F5 A0 23 7C 0D 87 78 21 F0 52 DF 38 19 CF E7 E7 ..#...x!.R.8.... 
0060: 7C 67 CD 42 DA          .g.B. 
xxx, WRITE: SSLv2 client hello message, length = 101 
[Raw write]: length = 103 
0000: 80 65 01 03 01 00 3C 00 00 00 20 00 00 04 01 00 .e....<... ..... 
0010: 80 00 00 05 00 00 2F 00 00 33 00 00 32 00 00 0A ....../..3..2... 
0020: 07 00 C0 00 00 16 00 00 13 00 00 09 06 00 40 00 [email protected] 
0030: 00 15 00 00 12 00 00 03 02 00 80 00 00 08 00 00 ................ 
0040: 14 00 00 11 00 00 FF 51 92 00 D8 9A 97 E1 80 7F .......Q........ 
0050: 89 C6 F5 A0 23 7C 0D 87 78 21 F0 52 DF 38 19 CF ....#...x!.R.8.. 
0060: E7 E7 7C 67 CD 42 DA        ...g.B. 
[Raw read]: length = 5 
0000: 15 03 01 00 02          ..... 
[Raw read]: length = 2 
0000: 02 46            .F

{} http://xml.apache.org/axis/堆栈跟踪：

javax.net.ssl.SSLException: Received fatal alert: protocol_version 
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:190) 
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136) 
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1806) 
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:986) 
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1170) 
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1197) 
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1181) 
at org.apache.axis.components.net.JSSESocketFactory.create(JSSESocketFactory.java:186) 
at

...

你在用什么服务器？ – CloudyMarble 2013-05-14 11:29:04

答

这似乎是一个协议版本不匹配，此异常通常发生在有由所使用的SSL协议版本之间存在不匹配客户端和服务器。你的客户应该使用服务器支持的协议版本。

感谢您的解释。我会告诉你，如果我的问题是固定的:) – Matthias 2013-05-14 11:38:01

答

这是由于您发送TLSv1握手的事实，但您使用SSLv2协议发送消息;

xxx, WRITE: TLSv1 Handshake, length = 75 
xxx, WRITE: SSLv2 client hello message, length = 101

这意味着服务器期望使用TLSv1协议并且不会接受连接。尝试指定要使用的协议，或发布一些相关的代码，以便我们可以看看

这似乎是正常的根据http://docs.oracle.com/javase/1.5.0/docs/guide/security/jsse/ReadDebug.html虽然 – Matthias 2013-05-14 11:35:47

你的服务器支持哪些协议？ – 2013-05-14 11:52:39

答

在Java 1.8上，默认的TLS协议是v1.2。在Java 1.6和1.7上，默认是已过时的TLS1.0。我在Java 1.8上得到这个错误，因为url使用旧的TLS1.0（像你 - 你看到ClientHello, TLSv1）。要解决此错误，您需要为Java 1.8使用覆盖默认值。

System.setProperty("https.protocols", "TLSv1");

有关Oracle blog的更多信息。

请参阅https://stackoverflow.com/a/47717547/1497139了解更多协议设置 – 2017-12-08 15:40:22

答

marioosh的答案似乎在正确的轨道上。它不适合我。所以我发现：

Problems connecting via HTTPS/SSL through own Java client

它使用：

java.lang.System.setProperty("https.protocols", "TLSv1,TLSv1.1,TLSv1.2");

这似乎是必要的Java 7和TLSv1.2工作现场。

我检查该网站有：使用

openssl version 
OpenSSL 1.0.2l 25 May 2017

openssl s_client -connect www.st.nmfs.noaa.gov:443

，并得到了结果：

... 
SSL-Session: 
    Protocol : TLSv1.2 
    Cipher : ECDHE-RSA-AES256-GCM-SHA384 
...

请注意，我的Mac机和旧的OpenSSL的版本没有工作我不得不使用macports之一。

javax.net.ssl.SSLException：收到致命警报：protocol_version

相关推荐