努力在 Apache CXF 中启用 SSLv2Hello，Java 8，否 Spring
Struggling to enable SSLv2Hello in Apache CXF, Java 8, No Spring
这似乎是倒退的，但我正在开发一个专门用于与第三方客户端交互的 Web 服务器。此第三方客户端仅支持 SSLv3、TLSv1.0 或 TLSv1.1。
当他们尝试连接时，我也看到了以下错误：
SSLHandshakeException: SSLv2Hello is not enabled
我认为这意味着他们还需要启用 SSLv2Hello。它显然不适合我，尽管它似乎可用。
2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Protocols [TLSv1.1, TLSv1] of [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Ciphers [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] of [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
不确定这是否是误会，但如果我尝试对 SSLContext.getInstances 执行以下操作，TLSv1.1 调用工作正常，SSLv2Hello 抛出 NoSuchAlgorithmException。
SSLContext.getInstance( "TLSv1.1" )
SSLContext.getInstance( "SSLv2Hello" )
我 运行 编写的代码仍然是一团糟，因为我正在制作原型，但下面是我正在做的事情的要点。
final String url = "https://myurl.com:443/Notices";
TLSServerParameters params = new TLSServerParameters();
List<String> certFilePaths = new ArrayList<>();
certFilePaths.add( "COMODORSADomainValidationSecureServerCA.crt" );
certFilePaths.add( "AddTrustExternalCARoot.crt" );
certFilePaths.add( "COMODORSAAddTrustCA.crt" );
certFilePaths.add( "MyCert.crt" );
Utility.loadCertsToServerParams( certFilePaths, "SSL_Export.pfx", "/tmp/tmp.jks", "password", params ); //uses the ssl password as the temporary keystore password as well
JettyHTTPServerEngineFactory serverEngineFactory = new JettyHTTPServerEngineFactory();
serverEngineFactory.setTLSServerParametersForPort( 443, params );
Consumer implementor = new Consumer();
JaxWsServerFactoryBean factory = new JaxWsServerFactoryBean();
factory.setServiceClass( Consumer.class );
factory.setAddress( url );
factory.setServiceBean( implementor );
Map<String, Object> properties = Maps.newHashMap();
properties.put( "mtom-enabled", "false" );
factory.setProperties( properties );
final Map<String, Object> inProps = Utility.getWsSecurityPropertiesForSSL( "/tmp/tmp.jks", "SSL_Export.pfx", "password", "SSL_Export" );
WSS4JInInterceptor wssOut = new WSS4JInInterceptor( inProps );
factory.getInInterceptors().add( wssOut );
ServerImpl server = ( ServerImpl ) factory.create();
server.start();
public static TrustManager[] loadCertsToServerParams( List<String> serverCertFilePaths, String sslTlsKeyPairPath, String tempPathForCertFileKeystore, String sslTslKeyPairPassword, TLSServerParameters params ) throws Exception
{
char[] sslTslKeyPairPasswordCharArray = sslTslKeyPairPassword.toCharArray();
//clear out the keystore, we create a new one every time
if( Files.exists( Paths.get( tempPathForCertFileKeystore ) ) )
Files.delete( Paths.get( tempPathForCertFileKeystore ) );
KeyStore ks = KeyStore.getInstance( "PKCS12" );
ks.load( new FileInputStream( sslTlsKeyPairPath ), sslTslKeyPairPasswordCharArray );
// Store away the newly created keystore.
FileOutputStream fos = new FileOutputStream( tempPathForCertFileKeystore );
ks.store( fos, sslTslKeyPairPasswordCharArray );
fos.close();
for( String certFilePath : serverCertFilePaths )
AddCertToKeystore( ks, sslTslKeyPairPasswordCharArray, tempPathForCertFileKeystore, certFilePath, new File( certFilePath ).getName().replace( '.', '_' ) );
TrustManagerFactory tmf = TrustManagerFactory.getInstance( TrustManagerFactory.getDefaultAlgorithm() );
tmf.init( ks );
KeyManagerFactory kmf = KeyManagerFactory.getInstance( KeyManagerFactory.getDefaultAlgorithm() );
kmf.init( ks, sslTslKeyPairPasswordCharArray );
SSLContext tls1_1Context = SSLContext.getInstance( "TLSv1.1" );
tls1_1Context.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
SSLContext.setDefault( tls1_1Context );
SSLContext v2Hello = SSLContext.getInstance( "SSL" );
v2Hello.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
params.setTrustManagers( tmf.getTrustManagers() );
params.setKeyManagers( kmf.getKeyManagers() );
params.setSecureSocketProtocol( "SSL" );
final List<String> additionalProtocols = new ArrayList<>();
additionalProtocols.add( "SSLv2Hello" );
additionalProtocols.add( "SSLv3" );
additionalProtocols.add( "TLSv1" );
additionalProtocols.add( "TLSv1.1" );
additionalProtocols.add( "TLSv1.2" );
params.setIncludeProtocols( additionalProtocols );
params.setExcludeProtocols( null );
final FiltersType cipherFilter = new FiltersType();
cipherFilter.getInclude().add( ".*NULL.*" );
cipherFilter.getInclude().add( ".*anon.*" );
cipherFilter.getInclude().add( ".*EXPORT.*" );
cipherFilter.getInclude().add( ".*DES.*" );
cipherFilter.getInclude().add( ".*MD5" );
cipherFilter.getInclude().add( ".*CBC.*" );
cipherFilter.getInclude().add( ".*RC4.*" );
cipherFilter.getInclude().add( ".*_.*" );
cipherFilter.getInclude().add( ".*AES.*" );
cipherFilter.getInclude().add( ".*_SHA" );
cipherFilter.getExclude().add( "" );
params.setCipherSuitesFilter( cipherFilter );
final List<String> cipherSuites = new ArrayList<>();
cipherSuites.add( "TLS_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" );
params.setCipherSuites( cipherSuites );
return tmf.getTrustManagers();
}
我已按照此 Jetty github 问题中的建议将 SSLv2Hello 明确设置为附加协议，我缺少什么才能启用 SSLv2Hello？
这似乎是一个 CXF 错误。如果我基于源副本创建自己的 JettyHTTPServerEngine 并添加以下行：
scf.setIncludeProtocols( "TLSv1", "TLSv1.1", "TLSv1.2", "SSLv2Hello" );
此方法：
protected SSLContext createSSLContext( SslContextFactory scf) throws Exception
然后行为如我所料，调试输出表明现在支持这些协议，并且连接成功。
Selected Protocols [TLSv1, TLSv1.1, TLSv1.2, SSLv2Hello] of [TLSv1.3,
TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
我在原始 JettyHTTPServerEngine 代码中的任何地方都看不到 setIncludeProtocols 函数，无论是在我的 3.2.4 版本中还是在 GitHub 的 master 上，所以我无法想象它是如何工作或应该如何工作的。
这似乎是倒退的，但我正在开发一个专门用于与第三方客户端交互的 Web 服务器。此第三方客户端仅支持 SSLv3、TLSv1.0 或 TLSv1.1。
当他们尝试连接时，我也看到了以下错误：
SSLHandshakeException: SSLv2Hello is not enabled
我认为这意味着他们还需要启用 SSLv2Hello。它显然不适合我，尽管它似乎可用。
2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Protocols [TLSv1.1, TLSv1] of [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
2019-06-13 15:06:38.831:DBUG:oejus.SslContextFactory:MyProgram: Selected Ciphers [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] of [TLS_AES_128_GCM_SHA256, TLS_AES_256_GCM_SHA384, TLS_CHACHA20_POLY1305_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
不确定这是否是误会，但如果我尝试对 SSLContext.getInstances 执行以下操作，TLSv1.1 调用工作正常，SSLv2Hello 抛出 NoSuchAlgorithmException。
SSLContext.getInstance( "TLSv1.1" )
SSLContext.getInstance( "SSLv2Hello" )
我 运行 编写的代码仍然是一团糟，因为我正在制作原型，但下面是我正在做的事情的要点。
final String url = "https://myurl.com:443/Notices";
TLSServerParameters params = new TLSServerParameters();
List<String> certFilePaths = new ArrayList<>();
certFilePaths.add( "COMODORSADomainValidationSecureServerCA.crt" );
certFilePaths.add( "AddTrustExternalCARoot.crt" );
certFilePaths.add( "COMODORSAAddTrustCA.crt" );
certFilePaths.add( "MyCert.crt" );
Utility.loadCertsToServerParams( certFilePaths, "SSL_Export.pfx", "/tmp/tmp.jks", "password", params ); //uses the ssl password as the temporary keystore password as well
JettyHTTPServerEngineFactory serverEngineFactory = new JettyHTTPServerEngineFactory();
serverEngineFactory.setTLSServerParametersForPort( 443, params );
Consumer implementor = new Consumer();
JaxWsServerFactoryBean factory = new JaxWsServerFactoryBean();
factory.setServiceClass( Consumer.class );
factory.setAddress( url );
factory.setServiceBean( implementor );
Map<String, Object> properties = Maps.newHashMap();
properties.put( "mtom-enabled", "false" );
factory.setProperties( properties );
final Map<String, Object> inProps = Utility.getWsSecurityPropertiesForSSL( "/tmp/tmp.jks", "SSL_Export.pfx", "password", "SSL_Export" );
WSS4JInInterceptor wssOut = new WSS4JInInterceptor( inProps );
factory.getInInterceptors().add( wssOut );
ServerImpl server = ( ServerImpl ) factory.create();
server.start();
public static TrustManager[] loadCertsToServerParams( List<String> serverCertFilePaths, String sslTlsKeyPairPath, String tempPathForCertFileKeystore, String sslTslKeyPairPassword, TLSServerParameters params ) throws Exception
{
char[] sslTslKeyPairPasswordCharArray = sslTslKeyPairPassword.toCharArray();
//clear out the keystore, we create a new one every time
if( Files.exists( Paths.get( tempPathForCertFileKeystore ) ) )
Files.delete( Paths.get( tempPathForCertFileKeystore ) );
KeyStore ks = KeyStore.getInstance( "PKCS12" );
ks.load( new FileInputStream( sslTlsKeyPairPath ), sslTslKeyPairPasswordCharArray );
// Store away the newly created keystore.
FileOutputStream fos = new FileOutputStream( tempPathForCertFileKeystore );
ks.store( fos, sslTslKeyPairPasswordCharArray );
fos.close();
for( String certFilePath : serverCertFilePaths )
AddCertToKeystore( ks, sslTslKeyPairPasswordCharArray, tempPathForCertFileKeystore, certFilePath, new File( certFilePath ).getName().replace( '.', '_' ) );
TrustManagerFactory tmf = TrustManagerFactory.getInstance( TrustManagerFactory.getDefaultAlgorithm() );
tmf.init( ks );
KeyManagerFactory kmf = KeyManagerFactory.getInstance( KeyManagerFactory.getDefaultAlgorithm() );
kmf.init( ks, sslTslKeyPairPasswordCharArray );
SSLContext tls1_1Context = SSLContext.getInstance( "TLSv1.1" );
tls1_1Context.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
SSLContext.setDefault( tls1_1Context );
SSLContext v2Hello = SSLContext.getInstance( "SSL" );
v2Hello.init( kmf.getKeyManagers(), tmf.getTrustManagers(), new SecureRandom() );
params.setTrustManagers( tmf.getTrustManagers() );
params.setKeyManagers( kmf.getKeyManagers() );
params.setSecureSocketProtocol( "SSL" );
final List<String> additionalProtocols = new ArrayList<>();
additionalProtocols.add( "SSLv2Hello" );
additionalProtocols.add( "SSLv3" );
additionalProtocols.add( "TLSv1" );
additionalProtocols.add( "TLSv1.1" );
additionalProtocols.add( "TLSv1.2" );
params.setIncludeProtocols( additionalProtocols );
params.setExcludeProtocols( null );
final FiltersType cipherFilter = new FiltersType();
cipherFilter.getInclude().add( ".*NULL.*" );
cipherFilter.getInclude().add( ".*anon.*" );
cipherFilter.getInclude().add( ".*EXPORT.*" );
cipherFilter.getInclude().add( ".*DES.*" );
cipherFilter.getInclude().add( ".*MD5" );
cipherFilter.getInclude().add( ".*CBC.*" );
cipherFilter.getInclude().add( ".*RC4.*" );
cipherFilter.getInclude().add( ".*_.*" );
cipherFilter.getInclude().add( ".*AES.*" );
cipherFilter.getInclude().add( ".*_SHA" );
cipherFilter.getExclude().add( "" );
params.setCipherSuitesFilter( cipherFilter );
final List<String> cipherSuites = new ArrayList<>();
cipherSuites.add( "TLS_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_CHACHA20_POLY1305_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_GCM_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_GCM_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_256_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA256" );
cipherSuites.add( "TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_ECDH_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_DHE_RSA_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_DHE_DSS_WITH_AES_128_CBC_SHA" );
cipherSuites.add( "TLS_EMPTY_RENEGOTIATION_INFO_SCSV" );
params.setCipherSuites( cipherSuites );
return tmf.getTrustManagers();
}
我已按照此 Jetty github 问题中的建议将 SSLv2Hello 明确设置为附加协议，我缺少什么才能启用 SSLv2Hello？
这似乎是一个 CXF 错误。如果我基于源副本创建自己的 JettyHTTPServerEngine 并添加以下行：
scf.setIncludeProtocols( "TLSv1", "TLSv1.1", "TLSv1.2", "SSLv2Hello" );
此方法：
protected SSLContext createSSLContext( SslContextFactory scf) throws Exception
然后行为如我所料，调试输出表明现在支持这些协议，并且连接成功。
Selected Protocols [TLSv1, TLSv1.1, TLSv1.2, SSLv2Hello] of [TLSv1.3, TLSv1.2, TLSv1.1, TLSv1, SSLv3, SSLv2Hello]
我在原始 JettyHTTPServerEngine 代码中的任何地方都看不到 setIncludeProtocols 函数，无论是在我的 3.2.4 版本中还是在 GitHub 的 master 上，所以我无法想象它是如何工作或应该如何工作的。