0

I'm not very familiar with the cryptography neither SSL/TLS protocol, although I went through the JSSE Reference Guide. I'm working on a project which demands some kind of security over TCP connection so I've chosen TLS as most common protocol to use.

I've found the piece of code for SSLSocket and SSLServerSocket on the JSSE Reference Guide and copied it in my project, but the outcome of that action was not really expected. When I started my server (Java application), everything seem to work to the point I tried to connect with the client (also Java application). At that point, SSLHandshakeException occurred: No cipher suite in common.

My question is, what is generally a cipher suite (I googled it but I didn't really understand, basic interpretation for beginners is what I need) and how I must fix the code given below to make my project work flawlessly?

SSLSocket:

import java.io.*;
import javax.net.ssl.*;

. . .

int port = availablePortNumber;
String host = "hostname";

try {
    SSLSocketFactory sslFact =
        (SSLSocketFactory)SSLSocketFactory.getDefault();
    SSLSocket s = (SSLSocket)sslFact.createSocket(host, port);

    OutputStream out = s.getOutputStream();
    InputStream in = s.getInputStream();

    // Send messages to the server through
    // the OutputStream
    // Receive messages from the server
    // through the InputStream
}

catch (IOException e) {
}

SSLServerSocket:

 import java.io.*;
import javax.net.ssl.*;

. . .

int port = availablePortNumber;

SSLServerSocket s;

try {
    SSLServerSocketFactory sslSrvFact =
        (SSLServerSocketFactory)SSLServerSocketFactory.getDefault();
    s = (SSLServerSocket)sslSrvFact.createServerSocket(port);

    SSLSocket c = (SSLSocket)s.accept();

    OutputStream out = c.getOutputStream();
    InputStream in = c.getInputStream();

    // Send messages to the client through
    // the OutputStream
    // Receive messages from the client
    // through the InputStream
}

catch (IOException e) {
}
Martin Mihalić
  • 17
  • 4

1 Answers1

1

You probably don't have a server certificate. You don't explicitly create an SSLContext, so the only way for your server to access a certificate and private key is if you run your program with certain system properties set. Without the necessary key material, only anonymous cipher suites will be enabled by the server.

Clients, by default, disable these anonymous cipher suites, since they don't actually provide any security. So, the handshake fails because there are no cipher suites in common.

erickson
  • 265,237
  • 58
  • 395
  • 493