ssl handShake failure soap

Question

I consuming a soap service via cxf that secured with ssl v3. I download .cer file from server and create JKS file via keytool with this instruction:

keytool -import -v -file iban.cer -keystore iban.jks

In java code i use this code for client config:

    public void configureSSLOnTheClient(Object c) {

        org.apache.cxf.endpoint.Client client = ClientProxy.getClient(c);
        HTTPConduit httpConduit = (HTTPConduit) client.getConduit();
        File truststore = new File("jks/iban.jks");                   

        try {
            TLSClientParameters tlsParams = new TLSClientParameters();
            tlsParams.setDisableCNCheck(true);


            KeyStore keyStore = KeyStore.getInstance("JKS");
            String trustpass = "password";

            keyStore.load(new FileInputStream(truststore), trustpass.toCharArray());

            log.info("Trust Manager Type:"+TrustManagerFactory.getDefaultAlgorithm());
            TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

            trustFactory.init(keyStore);
            TrustManager[] tm = trustFactory.getTrustManagers();
            tlsParams.setTrustManagers(tm);

            keyStore.load(new FileInputStream(truststore), trustpass.toCharArray());

            KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());

            keyFactory.init(keyStore, trustpass.toCharArray());
            KeyManager[] km = keyFactory.getKeyManagers();
            tlsParams.setKeyManagers(km);


            FiltersType filter = new FiltersType();
            filter.getInclude().add(".*_EXPORT_.*");
            filter.getInclude().add(".*_EXPORT1024_.*");
            filter.getInclude().add(".*_WITH_DES_.*");
            filter.getInclude().add(".*_WITH_NULL_.*");
            filter.getExclude().add(".*_DH_anon_.*");
            tlsParams.setCipherSuitesFilter(filter);

            httpConduit.setTlsClientParameters(tlsParams);

        } catch (KeyStoreException kse) {
            log.info("Security configuration failed with the following: KeyStoreException " + kse.getCause());
            kse.printStackTrace();
        } catch (NoSuchAlgorithmException nsa) {
            log.info("Security configuration failed with the following: NoSuchAlgorithmException" + nsa.getCause());
            nsa.printStackTrace();
        } catch (FileNotFoundException fnfe) {
            log.info("Security configuration failed with the following: FileNotFoundException" + fnfe.getCause());
        } catch (UnrecoverableKeyException uke) {
            log.info("Security configuration failed with the following: UnrecoverableKeyException" + uke.getCause());
        } catch (CertificateException ce) {
            log.info("Security configuration failed with the following: CertificateException" + ce.getCause());
        } catch (GeneralSecurityException gse) {
            log.info("Security configuration failed with the following: GeneralSecurityException" + gse.getCause());
        } catch (IOException ioe) {
            log.info("Security configuration failed with the following: IOException" + ioe.getCause());
        }

    }

And for calling service this code:

 String address = "https://xxxxxxxxxx/IBANSpecEnquiry/IBANSpec?wsdl";
    JaxWsProxyFactoryBean proxyFactory = new JaxWsProxyFactoryBean();
    proxyFactory.setServiceClass(IBANEnquirySpec.class);
    proxyFactory.setAddress(address);

    IBANEnquirySpec client = (IBANEnquirySpec) proxyFactory.create();
    configureSSLOnTheClient(client);
    Message04 message04 = client.getIBANSpec(message01);

When i running the code this error occures:

 Interceptor for {http://WebServices/}IBANEnquirySpecService#{http://WebServices/}getIBANSpec has thrown exception, unwinding now
org.apache.cxf.interceptor.Fault: Could not send Message.
at  org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingIntercept    or.handleMessage(MessageSenderInterceptor.java:64)
at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:272)
at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:570)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:479)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:382)
at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:335)
at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:136)
at com.sun.proxy.$Proxy143.getIBANSpec(Unknown Source)
at  ir.tejaratBank.service.impl.IBANClientManagerImpl.getIBANSpec(IBANClientManagerImpl.java:259)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
at java.lang.reflect.Method.invoke(Unknown Source)
. 
.
.
.
Caused by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://192.168.65.118:443/IBANSpecEnquiry/IBANSpec?wsdl: Received fatal alert: handshake_failure
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1347)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1331)
at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:632)
at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
... 128 more
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Unknown Source)
at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.setupWrappedStream(URLConnectionHTTPConduit.java:174)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1290)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1246)
at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.onFirstWrite(URLConnectionHTTPConduit.java:201)
at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:47)
at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69)
at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1303)
... 131 more

I search for this error and i realized that error is for bad trustStore. But i don't know how to generate correct trustStore.

I have same problem,Did your issue solved? – Hadi J Oct 17 '17 at 08:41 — Hadi J, Oct 17 '17 at 08:41

Nawar Khoury · Answer 1 · 2015-01-28T09:57:02.790

1

to generate the trust store, try using this:

keytool -import -alias youralias -file [path to certificate]/iban.cer -keystore [path to truststore.jks]/truststore.jks -storetype JKS

but what would be better, is not using all of this ssl configuration, and instead import the certificate to your java cacerts trust store using this:

keytool -import -v -file iban.cer -keystore %JAVA_HOME%/jre/lib/security/cacerts -alias youralias

edited Jan 28 '15 at 09:57

answered Jan 28 '15 at 09:48

Nawar Khoury

170
2
13

Thank you .I try to create jks file with your guidance but nothing happend in result – Ali_Rezvani Jan 31 '15 at 06:10
hey man, sorry I am late to reply. another way you can generate the truststore is using openssl, it is quite easy I am sure you can find out how with a small google search, but I also doubt it will work because I guess the problem you are having is not related to the truststore, I think it is some compatibility problem with the java version you are using... I suggest you try researching that. – Nawar Khoury Feb 02 '15 at 18:42
by the way what I usually do with clients making webservice calls over https is just importing the certificate to cacerts keystore in the java bin folder the client is using, using the second command I suggested in the answer, don't know if this helps but I think it is worth trying. – Nawar Khoury Feb 02 '15 at 18:45

score 0 · Answer 2 · edited May 23 '17 at 12:33

0

The error is not always indicative of a Trust Store problem. If you are using Java 8, SSLv3 may be disabled due to trying to avoid the POODLE attack.

See this related post: How to enable SSL 3 in Java

edited May 23 '17 at 12:33

Community

1
1

answered Jan 31 '15 at 07:19

jhoule86

56
3

ssl handShake failure soap

2 Answers2