RECV TLSv1 ALERT: fatal, handshake_failure - ssl on client side failed before "hello server"

Question

I try to create a client with ssl, using this code:

 ((BindingProvider) port).getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY,
                interfaceParameters.getUrl());
     Client client =
     ClientProxy.getClient(port);

     HTTPConduit httpConduit = (HTTPConduit)
     ((org.apache.cxf.endpoint.Client) client).getConduit();

     SSLClientParameters sParams = new SSLClientParameters();
     sParams.setTrustpass("client");
     sParams.setFilePath("C:/temp/client.keystore");
     httpConduit.setTlsClientParameters(sParams.getTLSClientParameters());

SSLClientParameters:

package --certification;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import java.security.UnrecoverableKeyException;
import java.security.cert.CertificateException;

import javax.net.ssl.KeyManager;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;

import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.configuration.security.FiltersType;

public class SSLClientParameters {




private String trustpass;
private String keyStoreName;
private String filePath;


public TLSClientParameters  getTLSClientParameters()
{
    TLSClientParameters tlsParams = new TLSClientParameters();
     try {

          tlsParams.setDisableCNCheck(true);
          tlsParams.setUseHttpsURLConnectionDefaultHostnameVerifier(false);
          tlsParams.setUseHttpsURLConnectionDefaultSslSocketFactory(false);
          System.setProperty("https.protocols", "TLSv1");
          KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
          File truststore = new File(filePath);
          keyStore.load(new FileInputStream(truststore), trustpass.toCharArray());


          TrustManagerFactory trustFactory = TrustManagerFactory.getInstance("SunX509");
          trustFactory.init(keyStore);
          TrustManager[] tm = trustFactory.getTrustManagers();
          tlsParams.setTrustManagers(tm);
          truststore = new File(filePath);
          keyStore.load(new FileInputStream(truststore), trustpass.toCharArray());
          KeyManagerFactory keyFactory = KeyManagerFactory.getInstance("SunX509");//KeyManagerFactory.getDefaultAlgorithm());
          keyFactory.init(keyStore, trustpass.toCharArray());
          KeyManager[] km = keyFactory.getKeyManagers();
          tlsParams.setKeyManagers(km);

          FiltersType filter = new FiltersType();
          filter.getInclude().add(".*_EXPORT_.*");
          filter.getInclude().add(".*_EXPORT1024_.*");
          filter.getInclude().add(".*_WITH_DES_.*");
          filter.getInclude().add(".*_WITH_NULL_.*");
          filter.getExclude().add(".*_DH_anon_.*");
          tlsParams.setCipherSuitesFilter(filter);


        } catch (KeyStoreException kse) {
          System.out.println("Security configuration failed with the following: " + kse.getCause());
        } catch (NoSuchAlgorithmException nsa) {
          System.out.println("Security configuration failed with the following: " + nsa.getCause());
        } catch (FileNotFoundException fnfe) {
          System.out.println("Security configuration failed with the following: " + fnfe.getCause());
        } catch (UnrecoverableKeyException uke) {
          System.out.println("Security configuration failed with the following: " + uke.getCause());
        } catch (CertificateException ce) {
          System.out.println("Security configuration failed with the following: " + ce.getCause());        
        } catch (IOException ioe) {
          System.out.println("Security configuration failed with the following: " + ioe.getCause());
        }
    return tlsParams;
}
public String getTrustpass() {
    return trustpass;
}


public void setTrustpass(String trustpass) {
    this.trustpass = trustpass;
}


public String getKeyStoreName() {
    return keyStoreName;
}

public void setKeyStoreName(String keyStoreName) {
    this.keyStoreName = keyStoreName;
}

public String getFilePath() {
    return filePath;
}

public void setFilePath(String filePath) {
    this.filePath = filePath;
}

}

when I run the client it failed with:

trigger seeding of SecureRandom
done seeding SecureRandom
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_anon_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DH_anon_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DH_anon_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
Ignoring unavailable cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
pool-3-thread-2, setSoTimeout(60000) called
Ignoring unsupported cipher suite: TLS_RSA_WITH_NULL_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_NULL_SHA256
%% No cached client session
*** ClientHello, TLSv1
RandomCookie:  GMT: 1438081664 bytes = { 185, 84, 103, 82, 0, 255, 203, 230, 236, 210, 88, 210, 33, 114, 146, 19, 144, 52, 77, 12, 72, 140, 191, 136, 70, 120, 182, 50 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_NULL_SHA, TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_RSA_WITH_NULL_SHA, TLS_ECDH_ECDSA_WITH_NULL_SHA, TLS_ECDH_RSA_WITH_NULL_SHA, TLS_ECDH_anon_WITH_NULL_SHA, SSL_RSA_WITH_NULL_MD5, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_KRB5_WITH_DES_CBC_SHA, TLS_KRB5_WITH_DES_CBC_MD5, TLS_KRB5_EXPORT_WITH_RC4_40_SHA, TLS_KRB5_EXPORT_WITH_RC4_40_MD5, TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA, TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension renegotiation_info, renegotiated_connection: <empty>
***
pool-3-thread-2, WRITE: TLSv1 Handshake, length = 152
pool-3-thread-2, READ: TLSv1 Alert, length = 2
pool-3-thread-2, RECV TLSv1 ALERT:  fatal, handshake_failure
pool-3-thread-2, called closeSocket()
pool-3-thread-2, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
pool-3-thread-2, called close()
pool-3-thread-2, called closeInternal(true)
Feb 07, 2016 5:32:41 PM org.apache.cxf.phase.PhaseInterceptorChain doDefaultLogging
WARNING: Interceptor for {http://sintecmedia.com/onboardAPI/GeneralService/}GeneralService#{http://sintecmedia.com/onboardAPI/GeneralService/}CreateOrUpdateEntity has thrown exception, unwinding now
org.apache.cxf.interceptor.Fault: Could not send Message.
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:64)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:272)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:565)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:474)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:377)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:330)
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:135)
    at com.sun.proxy.$Proxy116.createOrUpdateEntity(Unknown Source)
    at com.sintecmedia.job.handler.OnairToOnBoardExecute.invokeUpdateInsertEntities(OnairToOnBoardExecute.java:104)
    at com.sintecmedia.job.handler.OnairToOnBoardExecute.callOnairToOnBoardJob(OnairToOnBoardExecute.java:74)
    at com.sintecmedia.job.handler.OnairToOnBoardExecute.execute(OnairToOnBoardExecute.java:46)
    at com.sintecmedia.queue.handler.job.JobQueue.run(JobQueue.java:117)
    at com.sintecmedia.queue.QueuePoller.run(QueuePoller.java:81)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
    at java.util.concurrent.FutureTask.run(FutureTask.java:262)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:744)
Caused by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://172.16.2.66:8443/GenericMediator/camel/GeneralServiceSOAP: Received fatal alert: handshake_failure
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:526)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1339)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1323)
    at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
    at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:628)
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
    ... 18 more
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
    at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1959)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1077)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1091)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
    at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.setupWrappedStream(URLConnectionHTTPConduit.java:174)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1283)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1239)
    at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.onFirstWrite(URLConnectionHTTPConduit.java:201)
    at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:47)
    at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1296)
    ... 21 more

Feb 07, 2016 5:32:41 PM com.sintecmedia.job.handler.OnairToOnBoardExecute execute
INFO: javax.xml.ws.WebServiceException: Could not send Message.
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:146)
    at com.sun.proxy.$Proxy116.createOrUpdateEntity(Unknown Source)
    at com.sintecmedia.job.handler.OnairToOnBoardExecute.invokeUpdateInsertEntities(OnairToOnBoardExecute.java:104)
    at com.sintecmedia.job.handler.OnairToOnBoardExecute.callOnairToOnBoardJob(OnairToOnBoardExecute.java:74)
    at com.sintecmedia.job.handler.OnairToOnBoardExecute.execute(OnairToOnBoardExecute.java:46)
    at com.sintecmedia.queue.handler.job.JobQueue.run(JobQueue.java:117)
    at com.sintecmedia.queue.QueuePoller.run(QueuePoller.java:81)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
    at java.util.concurrent.FutureTask.run(FutureTask.java:262)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at java.lang.Thread.run(Thread.java:744)
Caused by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://172.16.2.66:8443/GenericMediator/camel/GeneralServiceSOAP: Received fatal alert: handshake_failure
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:526)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1339)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1323)
    at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
    at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:628)
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:272)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:565)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:474)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:377)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:330)
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:135)
    ... 11 more
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
    at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1959)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1077)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1091)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
    at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.setupWrappedStream(URLConnectionHTTPConduit.java:174)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1283)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1239)
    at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.onFirstWrite(URLConnectionHTTPConduit.java:201)
    at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:47)
    at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1296)
    ... 21 more

note that it's failed after "client hello" and the server didn't get anything yet.

can anyone please help me?

Note that when you see "Ignoring unavailable cipher suite" you probably have old US export policy. So you should update Java Cryptho Extension (JCE) with new policies. Links for JCE for Java6, java7 and java8 are here: https://support.datastax.com/hc/en-us/articles/204226129-Receiving-error-Caused-by-java-lang-IllegalArgumentException-Cannot-support-TLS-RSA-WITH-AES-256-CBC-SHA-with-currently-installed-providers-on-DSE-startup-after-setting-up-client-to-node-encryption — Nux, Oct 17 '20 at 15:49

score 3 · Accepted Answer · edited Jun 20 '20 at 09:12

3

pool-3-thread-2, WRITE: TLSv1 Handshake, length = 152
pool-3-thread-2, READ: TLSv1 Alert, length = 2
pool-3-thread-2, RECV TLSv1 ALERT:  fatal, handshake_failure
note that it's failed after "client hello" and the server didn't get anything yet.

It looks like the server got something because it sent an TLSv1 ALERT back. There might be several reasons why the server does not like the ClientHello but one could be your choice of ciphers:

     filter.getInclude().add(".*_EXPORT_.*");
     filter.getInclude().add(".*_EXPORT1024_.*");
     filter.getInclude().add(".*_WITH_DES_.*");
     filter.getInclude().add(".*_WITH_NULL_.*");
     filter.getExclude().add(".*_DH_anon_.*");

This choice results in

Cipher Suites: [TLS_ECDHE_ECDSA_WITH_NULL_SHA, TLS_ECDHE_RSA_WITH_NULL_SHA, SSL_RSA_WITH_NULL_SHA, TLS_ECDH_ECDSA_WITH_NULL_SHA, TLS_ECDH_RSA_WITH_NULL_SHA, TLS_ECDH_anon_WITH_NULL_SHA, SSL_RSA_WITH_NULL_MD5, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_KRB5_WITH_DES_CBC_SHA, TLS_KRB5_WITH_DES_CBC_MD5, TLS_KRB5_EXPORT_WITH_RC4_40_SHA, TLS_KRB5_EXPORT_WITH_RC4_40_MD5, TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA, TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5]

No modern server will (hopefully) accept these ciphers since all of these are insecure, that is either old and weak (EXPORT,DES) or simply don't encrypt (NULL).

I would recommend to not set any cipher suites but stay with the default.

edited Jun 20 '20 at 09:12

Community

1
1

answered Feb 07 '16 at 16:44

Steffen Ullrich

114,247
10
131
172

thank you very much!, but now I'm getting "No trusted certificate found" , after ServerHello. note that in SOAPUI it works fine with the same keystore and address. – Rubin Feb 08 '16 at 11:14
@user5876574: much better. Now you are probably missing the necessary root CA or certificate in your keystore. Since I don't know which host your are trying to reach I cannot help you with finding the necessary certificate but http://stackoverflow.com/questions/4325263/how-to-import-a-cer-certificate-into-a-java-keystore might help you once you've found out which certificate you need to add. – Steffen Ullrich Feb 08 '16 at 12:18
the server provide me 2 files to use: client.keystore and client.cer, in the code I use the client.keystore file (because clien.cer failed with invalid format) and to the cacert file (in JAVAHOME...) I added the client.cer file (because the 2nd file failed with x.509 certificate ). the server side said I can use both of the files and it should work. can you please help me how to add the client.keystore file to cacert? – Rubin Feb 08 '16 at 13:59
@Rubin: both files probably contains the same information, only in a different format. That's why they say you can use both files. For java you could probably simply use the given keystore, see http://stackoverflow.com/questions/5871279/java-ssl-and-cert-keystore. If you want to use the existing keystore you need to import the certificate, see http://stackoverflow.com/questions/2138940/import-pem-into-java-key-store. – Steffen Ullrich Feb 08 '16 at 15:44
now I'm undrestanding that keystore is containing some cer's so, I have to add the cer to the cacerts and use the kestore on my java code. but now I'm getting this "No trusted certificate found" and in the log I see something strange: after *** ServerHello ... I see *** Certificate chain chain [0] = [ [ but with another cer, not mine... how can it be, am I missing something? – Rubin Feb 10 '16 at 11:33
@Rubin: I'm not really familiar with Java and keystores so I cannot do detailled help and see what you are doing wrong. Apart from that, the original question you had is long answered so you better ask a new question if you know have different problems. – Steffen Ullrich Feb 10 '16 at 13:24

RECV TLSv1 ALERT: fatal, handshake_failure - ssl on client side failed before "hello server"

1 Answers1