What is the reason for - java.security.spec.InvalidKeySpecException: Unknown KeySpec type: java.security.spec.ECPublicKeySpec

支付中心Project重構完成，經過本地測試，並未發現問題。發布到測試環境后，測試發現請求光大掃碼https接口時，出現了如下的異常：

javax.net.ssl.SSLException: Server key
	at sun.security.ssl.Handshaker.throwSSLException(Handshaker.java:1202) ~[na:1.7.0_65]
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223) ~[na:1.7.0_65]
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868) ~[na:1.7.0_65]
	at sun.security.ssl.Handshaker.process_record(Handshaker.java:804) ~[na:1.7.0_65]
	at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016) ~[na:1.7.0_65]
	at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312) ~[na:1.7.0_65]
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339) ~[na:1.7.0_65]
	at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323) ~[na:1.7.0_65]
	at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:290) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:259) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.conn.HttpClientConnectionOperator.connect(HttpClientConnectionOperator.java:125) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:319) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:363) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:219) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:195) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:86) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:108) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:184) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) ~[httpclient-4.3.6.jar:4.3.6]
	at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:106) ~[httpclient-4.3.6.jar:4.3.6]
	at com.emax.paycenter.common.util.PayCenterHttpClient.httpsPost(PayCenterHttpClient.java:87) ~[emax-paycenter-common-1.0.0-SNAPSHOT.jar:na]
	at com.emax.paycenter.thirdPlatform.swiftpass.service.impl.SwiftpassCommunicationUtil.communicate(SwiftpassCommunicationUtil.java:39)

Caused by: java.security.spec.InvalidKeySpecException: Unknown KeySpec type: java.security.spec.ECPublicKeySpec
	at org.bouncycastle.jce.provider.asymmetric.ec.KeyFactory.engineGeneratePublic(Unknown Source) ~[bcprov-jdk14-1.45.jar:1.45.0]
	at java.security.KeyFactory.generatePublic(KeyFactory.java:334) ~[na:1.7.0_65]
	at sun.security.ssl.HandshakeMessage$ECDH_ServerKeyExchange.(HandshakeMessage.java:1057) ~[na:1.7.0_65]
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:218) ~[na:1.7.0_65]
	... 74 common frames omitted

 

這個問題曾困擾了一哥們好幾天，做了一些嘗試，奇跡卻未如願出現。加上工作任務多，哥們很有些煩惱。

領導說讓我來協助一下。分析caused by的堆棧，可以看到問題出在bcprov-jdk14-1.45.jar包。

最終呢，我在stackoverflow.com里看到一個帖子，說的是bcprov的jar版本問題。后嘗試從maven官方庫將bcprov-jdk14-1.45.jar升級到bcprov-jdk16-1.46.jar。經過這幾天的復測和不斷測試，測試環境未出現以上bug。

        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcmail-jdk16</artifactId>
            <version>${bcmail-jdk16.version}</version>
        </dependency>
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk16</artifactId>
            <version>${bcprov-jdk16.version}</version>
        </dependency>

 

 

 

總結：

1.問題雖然解決了，其實還是有一些疑問的，為什么之前用bcprov-jdk14-1.45.jar沒有問題呢？ 也許是在這次Project重構時有些相關的jar的版本變更了， 或是在這段時間接新通道時引入了相關的jar，導致了bcprov-jdk14-1.45.jar的版本問題。

2.百度了一下bouncy castle。它是一種用於 Java 平台的開源的輕量級密碼術包；它支持大量的密碼術算法，並提供JCE 1.2.1的實現。同時大概接觸了一下java.security.*。

3.nothing is difficult if you put your heart into it.

 

BTW，“bouncy castle”這名字取的真不錯。castle是城堡，城堡給人安全。而bouncy是輕快的。bouncy castle意即充氣城堡，看來用bouncycastle作為輕量級安全包的名字是再合適不過了。類似的，“zookeeper”這個名字取得也讓人不折不扣地佩服，java平台的軟件就像一個動物園，而它是動物園管理者，牛逼至極！

 

ref：stackoverflow What is the reason for - java.security.spec.InvalidKeySpecException: does not support java.security.spec.ECPublicKeySpec?