1

We have a spring boot service (2.0) with SSL enabled rest end point. we have added the following properties in our application.properties

server.ssl.enabled:true
server.ssl.key-store-type=JKS
server.ssl.key-store:test.jks
server.ssl.key-store-password:123234
server.ssl.key-alias: test-service
server.ssl.ciphers=RSA_WITH_AES_256_CBC_SHA256
server.ssl.protocol=TLS

But we are getting this exception while starting service

Caused by: java.lang.IllegalArgumentException: None of the [ciphers] specified are supported by the SSL engine : [[]]
        at org.apache.tomcat.util.net.SSLUtilBase.getEnabled(SSLUtilBase.java:91) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.tomcat.util.net.SSLUtilBase.<init>(SSLUtilBase.java:65) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.tomcat.util.net.jsse.JSSEUtil.<init>(JSSEUtil.java:144) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.tomcat.util.net.jsse.JSSEImplementation.getSSLUtil(JSSEImplementation.java:50) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:104) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.tomcat.util.net.AbstractJsseEndpoint.initialiseSsl(AbstractJsseEndpoint.java:87) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.tomcat.util.net.NioEndpoint.bind(NioEndpoint.java:225) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.tomcat.util.net.AbstractEndpoint.start(AbstractEndpoint.java:1150) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.coyote.AbstractProtocol.start(AbstractProtocol.java:591) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.catalina.connector.Connector.startInternal(Connector.java:1018) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]
        at org.apache.catalina.util.LifecycleBase.start(LifecycleBase.java:150) ~[tomcat-embed-core-8.5.28.jar!/:8.5.28]

Any help to fix this issue?. Tried with Cipher suite flag using Customizer

@Bean
    public WebServerFactoryCustomizer<TomcatServletWebServerFactory> sessionManagerCustomizer() {
        msgLogger.info("Inside webserver container bean to enable cipher suite config");
            return server -> server.addConnectorCustomizers((connector) -> {
                ((AbstractHttp11Protocol<?>) connector.getProtocolHandler())
                .setUseServerCipherSuitesOrder(Boolean.toString(true));
    });
    }

Any help is much appreciated. We are stuck in this for more than 2 days. Thanks

Sudharsan
  • 207
  • 1
  • 2
  • 12
  • Short answer from [duplicate](https://stackoverflow.com/a/48934806/5221149): You need to install the Java Cryptography Extension (JCE) Unlimited Strength Jurisdiction Policy Files. – Andreas Aug 24 '18 at 18:06
  • No. its not a duplicate. The client system is sending RSA_WITH_AES_256_CBC_SHA256 whereas the tomcat SSL is TLS_RSA_WITH_AES_256_CBC_SHA256 due to which i am getting the exception – Sudharsan Aug 25 '18 at 00:04
  • Error says *"None of the [ciphers] **specified** are supported"*. The entry `server.ssl.ciphers=RSA_WITH_AES_256_CBC_SHA256` is the *specification* it is referring to, and it says that none of the ciphers listed (all 1 of them) are *supported*. From my reading of the stack trace, the error occurs when it is trying to initialize the SSL Engine, i.e. *before* it has connected to the remote system, so the error is not about the remote system, but entirely about your configuration. – Andreas Aug 25 '18 at 03:16
  • As the client system cipher RSA_WITH_AES_256_CBC_SHA256 was not detected by SSL engine, i got an exception after enabling SSL log (javax.net.ssl.SSLHandshakeException: no cipher suites in common ) . Due to which , i had to specify it in properties file. Thats when i got this issue while starting the service – Sudharsan Aug 25 '18 at 18:27
  • If you run the code shown in the duplicate, you see which ciphers you do have. If output is like in the duplicate, you'd see that there is no such cipher as `RSA_WITH_AES_256_CBC_SHA256`. There is one prefixed with `TLS_DHE_`, and another with just `TLS_`. – Andreas Aug 25 '18 at 23:11
  • @Andreas, according to this: https://stackoverflow.com/questions/1179672/how-to-avoid-installing-unlimited-strength-jce-policy-files-when-deploying-an JCE is enabled by default already starting from certain minor version of major java releases. – Artanis Zeratul Jun 24 '19 at 23:43

0 Answers0