SSLv3 Alert fatal, unexpected message

Please help!

I've to connect to an IBM HttpServer with client authentication. During handshake i get a fatal, unexpected message exception. It works if i'm connecting without client authentication to the same server.

I've absolutly no idea what that exception could mean and how to solve it and i couldn't find any clues in that forum.

Had anybody the same problem?

Alex

0B40: A9 .

main, WRITE: SSL v3.0 Handshake, length = 2881

SESSION KEYGEN:

PreMaster Secret:

0000: 03 00 B8 AE 95 F0 C1 7976 AC C8 22 C6 62 AC 64 .......yv..".b.d

0010: 1F B5 F7 F0 57 92 FE 68D1 58 5B 41 79 A6 34 74 ....W..h.X[Ay.4t

0020: E6 90 4F B0 AD DC D2 6560 AA 8C 32 EF 2F 8D A6 ..O....e`..2./..

CONNECTION KEYGEN:

Client Nonce:

0000: 3C 14 E3 F7 66 F5 C5 0981 73 92 6C 44 08 89 CB <...f....s.lD...

0010: 6E 73 CD 91 1B 30 DE 68A9 6D 36 6A CC EC E5 3F ns...0.h.m6j...?

Server Nonce:

0000: 2F F2 25 50 EC F9 58 68A7 8D 78 87 80 B4 86 59 /.%P..Xh..x....Y

0010: B7 1D 89 0C 69 F8 F3 5629 3A 6A BE B7 D6 2C 51 ....i..V):j...,Q

Master Secret:

0000: 20 86 58 2B 31 83 FB 0A13 1F 9D D9 3D 08 9C D8.X+1.......=...

0010: A2 CB 34 1F DA EF A4 9DF6 F9 8E 67 89 AB 5F 03 ..4........g.._.

0020: 44 2F D2 35 A3 5D 05 2211 48 E4 85 BA 12 7A F8 D/.5.].".H....z.

Client MAC write Secret:

0000: 4D 6B B4 61 25 61 83 7424 C4 EA 63 F2 AF B7 FC Mk.a%a.t$..c....

Server MAC write Secret:

0000: F7 AA 46 51 62 47 68 656A 1D 90 9F AE C0 B3 15 ..FQbGhej.......

Client write key:

0000: 9D 59 95 5B 5F AD 67 7EE4 B5 B8 D7 3A 24 44 D1 .Y.[_.g.....:$D.

Server write key:

0000: 93 D6 F6 1B 5C 05 5D 846A 61 9E 8C 71 8E CC 48 ....\.].ja..q..H

... no IV for cipher

*** CertificateVerify

[write] MD5 and SHA1 hashes: len = 134

0000: 0F 00 00 82 00 80 86 C5AC 73 08 C6 A3 5E 9C D6 .........s...^..

0010: 4F 91 F9 27 31 B7 48 9BF0 96 66 EC 2B 5B 89 5E O..'1.H...f.+[.^

0020: 05 47 B4 A1 73 9E 5E C3DA 9E B6 D9 47 66 81 12 .G..s.^.....Gf..

0030: BD FD 0E 7E 61 E6 04 D8A4 CF 44 44 D1 58 34 B6 ....a.....DD.X4.

0040: A1 AA E5 1D 9D 09 1C 2030 6E 8F 82 D4 6F 08 B3 ....... 0n...o..

0050: E2 3C 80 F2 6E 4E 69 5D81 68 12 44 0D 4D 11 A4 .<..nNi].h.D.M..

0060: 3B 3A AB 1A 40 8E 52 B15C B0 B6 F6 D5 A5 C3 87 ;:..@.R.\.......

0070: 84 90 DF BC 5C 9A 63 3AE3 85 B6 80 6F 02 27 42 ....\.c:....o.'B

0080: EE 52 EB 10 22 1D .R..".

main, WRITE: SSL v3.0 Handshake, length = 134

main, WRITE: SSL v3.0 Change Cipher Spec, length = 1

*** Finished, v3.0

MD5 Hash: { 207, 81, 70, 113, 32, 221, 147, 109, 247, 175, 191, 53, 235, 230, 5

6, 241 }

SHA1 Hash: { 173, 191, 143, 197, 124, 50, 48, 95, 148, 88, 77, 36, 77, 11, 196,

114, 74, 169, 156, 190 }

***

[write] MD5 and SHA1 hashes: len = 40

0000: 14 00 00 24 CF 51 46 7120 DD 93 6D F7 AF BF 35 ...$.QFq ..m...5

0010: EB E6 38 F1 AD BF 8F C57C 32 30 5F 94 58 4D 24 ..8......20_.XM$

0020: 4D 0B C4 72 4A A9 9C BEM..rJ...

Plaintext before ENCRYPTION: len = 56

0000: 14 00 00 24 CF 51 46 7120 DD 93 6D F7 AF BF 35 ...$.QFq ..m...5

0010: EB E6 38 F1 AD BF 8F C57C 32 30 5F 94 58 4D 24 ..8......20_.XM$

0020: 4D 0B C4 72 4A A9 9C BE77 9E 96 A4 FA D5 2A 7C M..rJ...w.....*.

0030: 0C A8 E4 47 11 C8 A7 23...G...#

main, WRITE: SSL v3.0 Handshake, length = 56

main, READ: SSL v3.0 Alert, length = 2

main, RECV SSLv3 ALERT: fatal, unexpected message

javax.net.ssl.SSLException: Received fatal alert: unexpected message

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.b([DashoPro-V1.2-120198])

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])

at com.sun.net.ssl.internal.ssl.AppOutputStream.write([DashoPro-V1.2-120

198])

at java.io.OutputStream.write(OutputStream.java:61)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake([DashoPro-V

1.2-120198])

at cer.main(cer.java:389)

[4207 byte] By [CervenkaA] at [2007-9-26 15:02:07]
# 1

I got the same error message you have with the JRE 1.4.0 beta3. (The JSSE is now a part of the J2RE).

If you are using that, go back to J2RE 1.3.1 + JSSE and try again. Here's my original bug message:

I think I found a bug in the Java Runtime beta 1.4.0 that has to do with JSSE (the Java Secure Sockets Extensions).

I'm using a Java client to do a HTTP POST request to an OpenSSL HTTP server (port 443). I'm using the ssldump utility from Eric Rescorla to trace the SSL handshake messages.

When the Java client connects for the first time to an OpenSSL HTTPS server, the handshake works fine and data can be send and received. I'm sending data with the POST command and receive some text back.

With the second POST request, the Java client sends an SSL client hello message to start renegotiation, an right after that the POST header data!

The OpenSSL server in turn, sends a SSL server hello back and expects the Java client to send a ChangeCipherSpec instead of user data.

Because the ChangeCipherSpec doesn't arrive but instead user data, the OpenSSL library generates an alert: SSLv3 fatal alert: unexpected message.

This will trigger the Java client to close the TCP/IP session and retry with a full handshake, which succeeds.

So in the end, the second POST request succeeds, but only after an SSL alert and TCP re-connect, which is of course very inefficient.

John Douwes

Fenestrae B.V.

The Netherlands

JohnDo@fenestrae.com

JohnDo at 2007-7-2 17:22:30 > top of Java-index,Java Mobility Forums,Consumer and Commerce...