SSLv3協議、TLSv1.2協議配置不對導致javax.ws.rs.ProcessingException: java.net.SocketException: Connection reset

SSl：Secure Sockets Layer 安全套接層

TLS:Transport Layer Security傳輸層安全

是為網絡通信提供安全及數據完整性的一種安全協議。TLS與SSL在傳輸層對網絡連接進行加密。(見百度)

場景描述：將公司請求第三方公司的接口協議由http改成https后，出現了請求套接字異常的情況，第三方公司也收不到具體的請求，具體異常如下,

javax.ws.rs.ProcessingException: java.net.SocketException: Connection reset
at org.glassfish.jersey.client.internal.HttpUrlConnector.apply(HttpUrlConnector.java:287)
at org.glassfish.jersey.client.ClientRuntime.invoke(ClientRuntime.java:252)
at org.glassfish.jersey.client.JerseyInvocation$1.call(JerseyInvocation.java:684)
at org.glassfish.jersey.client.JerseyInvocation$1.call(JerseyInvocation.java:681)
at org.glassfish.jersey.internal.Errors.process(Errors.java:315)
at org.glassfish.jersey.internal.Errors.process(Errors.java:297)
at org.glassfish.jersey.internal.Errors.process(Errors.java:228)
at org.glassfish.jersey.process.internal.RequestScope.runInScope(RequestScope.java:444)
at org.glassfish.jersey.client.JerseyInvocation.invoke(JerseyInvocation.java:681)
at org.glassfish.jersey.client.JerseyInvocation$Builder.method(JerseyInvocation.java:411)
at org.glassfish.jersey.client.JerseyInvocation$Builder.get(JerseyInvocation.java:311)
at com.baoxian.payment.UnionPayPayment.request(UnionPayPayment.java:323)
...

Caused by: java.net.SocketException: Connection reset
at java.net.SocketInputStream.read(SocketInputStream.java:209)
at java.net.SocketInputStream.read(SocketInputStream.java:141)
at sun.security.ssl.InputRecord.readFully(InputRecord.java:465)
at sun.security.ssl.InputRecord.read(InputRecord.java:503)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1513)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1441)
at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:338)
at org.glassfish.jersey.client.internal.HttpUrlConnector._apply(HttpUrlConnector.java:394)
at org.glassfish.jersey.client.internal.HttpUrlConnector.apply(HttpUrlConnector.java:285)
... 66 more

實現http協議的代碼為：

import java.security.SecureRandom;
import java.security.cert.X509Certificate;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import javax.ws.rs.client.Client;
import javax.ws.rs.client.ClientBuilder;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

public class ClientUtil {
    private static Log log = LogFactory.getLog(ClientUtil.class);
    private static SSLContext sslContext = null;
    private static HostnameVerifier hv = null;
    public static Client sslClient = null;
    public static Client client = null;
    static{
        client = ClientBuilder.newClient();
        try {
            sslContext = SSLContext.getInstance("SSLv3");
            sslContext.init(null, new TrustManager[] { new X509TrustManager() {
                public X509Certificate[] getAcceptedIssuers() {
                    return new X509Certificate[0];
                }

                public void checkClientTrusted(X509Certificate[] certs, String authType) {
                }

                public void checkServerTrusted(X509Certificate[] certs, String authType) {
                }
            } }, new SecureRandom());
        } catch (Exception e) {
            log.error("SSL失敗", e);
        }
        hv = new HostnameVerifier() {
            public boolean verify( String arg0, SSLSession arg1 ) { return true; }
        };
        sslClient = ClientBuilder.newBuilder().hostnameVerifier(hv).sslContext(sslContext).build();
    }
}

調用ClientUtil類的代碼

        url = url + "?data=" + URLEncoder.encode(jsonObject.toJSONString(), "UTF-8");
        log.info("銀聯請求: type: " + transType + ", URL:" + url);
        4 
        Response response = ClientUtil.client.
                 .target(url)
                .request()
                .get();

這里的代碼寫死了只能用SSLv3安全協議，一運行的時候就報連接錯誤。可是，同樣的請求放到google瀏覽器上請求就可以通過。

把請求復制到google瀏覽器請求欄，按F12,點擊enter鍵，查看Security菜單欄輸出的網頁內容，發現這個請求接受TLS1.2安全協議

為了不影響其它類使用SSL協議，對這個類進行重寫。重寫后類，新增了獲取制定安全協議的方法，支持指定安全協議的請求。

import java.security.SecureRandom;
import java.security.cert.X509Certificate;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;
import javax.ws.rs.client.Client;
import javax.ws.rs.client.ClientBuilder;

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

public class ClientUtil {
    private static Log log = LogFactory.getLog(ClientUtil.class);
    private static SSLContext sslContext = null;
    private static HostnameVerifier hv = null;
    public static Client sslClient = null;
    public static Client client = null;
    private static TrustManager simpleTrust=null;
    static{
        client = ClientBuilder.newClient();
        try {
            sslContext = SSLContext.getInstance("SSLv3");
            simpleTrust=new X509TrustManager() {
                public X509Certificate[] getAcceptedIssuers() {
                    return new X509Certificate[0];
                }

                public void checkClientTrusted(X509Certificate[] certs, String authType) {
                }

                public void checkServerTrusted(X509Certificate[] certs, String authType) {
                }
            };
            sslContext.init(null, new TrustManager[] { simpleTrust}, new SecureRandom());
        } catch (Exception e) {
            log.error("SSL失敗", e);
        }
        hv = new HostnameVerifier() {
            public boolean verify( String arg0, SSLSession arg1 ) { return true; }
        };
        sslClient = ClientBuilder.newBuilder().hostnameVerifier(hv).sslContext(sslContext).build();
    }

    public static Client getSslClient(String protocol)
    {
        try {
            SSLContext sslContextTmp= SSLContext.getInstance(protocol);
            sslContextTmp.init(null, new TrustManager[] { simpleTrust}, new SecureRandom());
            return ClientBuilder.newBuilder().hostnameVerifier(hv).sslContext(sslContextTmp).build();
        }
        catch (Exception ex)
        {
            return ClientBuilder.newBuilder().hostnameVerifier(hv).sslContext(sslContext).build();
        }
    }
}

 

改正后的調用方法

        url = url + "?data=" + URLEncoder.encode(jsonObject.toJSONString(), "UTF-8");

        Response response = ClientUtil.getSslClient("TLSv1.2")
                .target(url)
                .request()
                .get();

 

說明：不同第三方公司支持https協議的時候可以用不同安全協議，對於不同的情況要予以考慮。