Home.... | log in.... | Pub my question! | Sign-up....
Java-index >> Security >> Java Secure Socket Extension (JSSE)

Connecting to a Secured server : bad_record_mac

Hi,

I'm in trouble while trying to connect to a HTTPS server via Java (jdk1.5), which use certificate.

When using Firefox, or Explorer, it ask me if I accept the certificate, and there is no problems there.

But I have to test the webserver using jMeter, and each times I try to access the server, java fails with the following exception :

javax.net.ssl.SSLException: Received fatal alert: bad_record_mac

at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)

at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(Unknown Source)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)

at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)

at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)

at com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnectionOldImpl.connect(Unknown Source)

at org.apache.jmeter.protocol.http.sampler.HTTPSampler.sample(HTTPSampler.java:424)

at org.apache.jmeter.protocol.http.sampler.HTTPSamplerBase.sample(HTTPSamplerBase.java:514)

at org.apache.jmeter.protocol.http.sampler.HTTPSamplerBase.sample(HTTPSamplerBase.java:503)

at org.apache.jmeter.threads.JMeterThread.run(JMeterThread.java:247)

at java.lang.Thread.run(Unknown Source)

Thus, I tried HTTPClient from jakarta, and it give the same result.

The problem is with the certificate (it connect to the server) : a normal browser should ask me to accept it or refuse it. But Java, simply denies it except if it's in the trustStore.

1. I have the certificat from the server side, and I can import it into my truststore using keytool :

$ keytool -import -v -trustcacerts -alias glowria -file www.glowria.fr.crt -keys

tore foo.keystore -storepass changeit

Certificat ajout?au Keystore

[Stockage de foo.keystore]

$ keytool -export -keystore foo.keystore -alias glowria -file glowria.cer

Tapez le mot de passe du Keystore : *********

Certificat enregistr?dans le fichier <glowria.cer>

$ keytool -import -keystore jssecacerts -alias glowria -file glowria.cer

Tapez le mot de passe du Keystore : *********

Faire confiance ?ce certificat ? [non] : oui

Certificat ajout?au Keystore

(note: I'm using WinXP_FR, sorry for the accents)

2. finally, I have the same bad_record_mac, whatever happens

--

So, what step should I observe to correct this?

Note that I also tried to use javaws, to import a certificat either after exporting the certificat from IE (in DER format, *.cer), either with the certificat I got in my apache 2 conf. But, that does not solve the problem.

Is someone has Idea of what to do? (except from using Java code, I'm supposed to use jMeter, in which I would like to avoid using java code)

[3218 byte] By [Balduriena] at [2007-10-2 19:56:25]
«« RMI and concurrency (newbie)
»» Problem while maintaining the Session
# 1

Here are the log :

setting up default SSLSocketFactory

use default SunJSSE impl class: com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl

class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl is loaded

keyStore is :

keyStore type is : jks

keyStore provider is :

init keystore

init keymanager of type SunX509

trustStore is: C:\Documents and Settings\glhez\.keystore

trustStore type is : jks

trustStore provider is :

init truststore

adding as trusted cert:

Subject: EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=mailetud.univ-mlv.fr,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

ST=Ile de France, C=FR

Issuer: EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=etudiant CA,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

L=Champs-sur-Marne - Marne-la-Vallee, ST=Ile de France, C=FR

Algorithm: RSA; Serial number: 0x1

Valid from Mon Oct 27 16:29:06 CET 2003 until Wed Oct 26 17:29:06 CEST 2005

adding as trusted cert:

Subject: CN=www.glowria.fr, O=glow entertainment group, L=paris, ST=idf, C=FR

Issuer: EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA,

OU=Certification Services Division, O=Thawte Consulting cc,

L=Cape Town, ST=Western Cape, C=ZA

Algorithm: RSA; Serial number: 0x1de258b0fdc72c97ffea9e6aaa029200

Valid from Wed Apr 05 17:15:56 CEST 2006 until Thu Apr 05 17:15:56 CEST 2007

init context

trigger seeding of SecureRandom

done seeding SecureRandom

instantiated an instance of class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl

%% No cached client session

*** ClientHello, TLSv1

RandomCookie: GMT: 1148223512 bytes = {

153, 207, 180, 229, 117, 122, 114, 180, 80, 100, 177, 238, 96, 187, 53,

191, 23, 166, 177, 146, 109, 143, 212, 138, 86, 254, 253, 45 }

Session ID: {}

Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,

TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,

TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,

SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA,

SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA,

SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA,

SSL_RSA_EXPORT_WITH_RC4_40_MD5,

SSL_RSA_EXPORT_WITH_DES40_CBC_SHA,

SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,

SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]

Compression Methods: { 0 }

***

main, WRITE: TLSv1 Handshake, length = 73

main, WRITE: SSLv2 client hello message, length = 98

main, READ: SSLv3 Handshake, length = 74

*** ServerHello, SSLv3

RandomCookie: GMT: 1148223512 bytes = { 27, 221, 164, 45, 241, 200, 175,

126, 113, 183, 110, 203, 105, 36,

243, 208, 26, 233, 181, 185, 105,

217, 38, 75, 117, 185, 155, 195 }

Session ID: {245, 62, 57, 105, 181, 243, 236, 163, 163, 243, 111, 57, 154, 76,

10, 52, 139, 51, 1, 186, 56, 39, 126, 132, 77, 186, 70, 198, 39,

130, 140, 253}

Cipher Suite: SSL_RSA_WITH_RC4_128_MD5

Compression Method: 0

***

%% Created: [Session-1, SSL_RSA_WITH_RC4_128_MD5]

** SSL_RSA_WITH_RC4_128_MD5

main, READ: SSLv3 Handshake, length = 880

*** Certificate chain

chain [0] = [

[

Version: V3

Subject: CN=www.glowria.fr, O=glow entertainment group, L=paris, ST=idf, C=FR

Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4

Key: Sun RSA public key, 1024 bits

modulus: 1394675952191931268734820219992431570281157494335897246802

0198271226760372788150078078279885019986946058707859810832

1240405287064484394631511786422317392283850564895052452759

3436960651451659436995992246098579080819547231384707680882

4899135350812648011215965362507686058148718997242691065146

0397063561191007291

public exponent: 65537

Validity: [From: Wed Apr 05 17:15:56 CEST 2006,

To: Thu Apr 05 17:15:56 CEST 2007]

Issuer: EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA,

OU=Certification Services Division, O=Thawte Consulting cc,

L=Cape Town, ST=Western Cape, C=ZA

SerialNumber: [1de258b0 fdc72c97 ffea9e6a aa029200]

Certificate Extensions: 4

[1]: ObjectId: 2.5.29.31 Criticality=false

CRLDistributionPoints [

[DistributionPoint:

[URIName: http://crl.thawte.com/ThawtePremiumServerCA.crl]

]]

[2]: ObjectId: 2.5.29.37 Criticality=false

ExtendedKeyUsages [

[1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2]]

[3]: ObjectId: 2.5.29.19 Criticality=true

BasicConstraints:[

CA:false

PathLen: undefined

]

[4]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false

AuthorityInfoAccess [

[accessMethod: 1.3.6.1.5.5.7.48.1

accessLocation: URIName: http://ocsp.thawte.com]

]

]

Algorithm: [MD5withRSA]

Signature:

0000: 06 AC FD 5F D6 D0 3E 1F00 CB B0 D2 B4 4E 30 5A ..._..>......N0Z

0010: D2 0F 99 BC FD 0E C5 759A AD 28 1E 43 32 BB 3B .......u..(.C2.;

0020: 95 F8 E2 1F 4E 7F 12 4DA5 AA B8 B8 77 D1 22 80 ....N..M....w.".

0030: 07 21 6F B1 5B F4 66 54C5 83 F6 E7 3F 3B 11 C3 .!o.[.fT....?;..

0040: 88 04 06 B1 8A 83 2C 89C1 F1 A0 03 A5 1E 68 24 ......,.......h$

0050: 7A DA 23 CA 8C 9D E6 BF89 3B CE F7 7D 99 33 53 z.#......;....3S

0060: F5 01 95 CB 94 72 45 7DE4 31 82 64 7A 2E 4A 66 .....rE..1.dz.Jf

0070: DE 02 44 1E 88 49 82 0040 F2 C3 E1 2C 8B 34 EB ..D..I..@...,.4.

]

***

Found trusted certificate:

[

[

Version: V3

Subject: CN=www.glowria.fr, O=glow entertainment group, L=paris, ST=idf, C=FR

Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4

Key: Sun RSA public key, 1024 bits

modulus: 1394675952191931268734820219992431570281157494335897246

8020198271226760372788150078078279885019986946058707859

8108321240405287064484394631511786422317392283850564895

0524527593436960651451659436995992246098579080819547231

3847076808824899135350812648011215965362507686058148718

9972426910651460397063561191007291

public exponent: 65537

Validity: [From: Wed Apr 05 17:15:56 CEST 2006,

To: Thu Apr 05 17:15:56 CEST 2007]

Issuer: EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA,

OU=Certification Services Division, O=Thawte Consulting cc,

L=Cape Town, ST=Western Cape, C=ZA

SerialNumber: [1de258b0 fdc72c97 ffea9e6a aa029200]

Certificate Extensions: 4

[1]: ObjectId: 2.5.29.31 Criticality=false

CRLDistributionPoints [

[DistributionPoint:

[URIName: http://crl.thawte.com/ThawtePremiumServerCA.crl]

]]

[2]: ObjectId: 2.5.29.37 Criticality=false

ExtendedKeyUsages [

[1.3.6.1.5.5.7.3.1, 1.3.6.1.5.5.7.3.2]]

[3]: ObjectId: 2.5.29.19 Criticality=true

BasicConstraints:[

CA:false

PathLen: undefined

]

[4]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false

AuthorityInfoAccess [

[accessMethod: 1.3.6.1.5.5.7.48.1

accessLocation: URIName: http://ocsp.thawte.com]

]

]

Algorithm: [MD5withRSA]

Signature:

0000: 06 AC FD 5F D6 D0 3E 1F00 CB B0 D2 B4 4E 30 5A ..._..>......N0Z

0010: D2 0F 99 BC FD 0E C5 759A AD 28 1E 43 32 BB 3B .......u..(.C2.;

0020: 95 F8 E2 1F 4E 7F 12 4DA5 AA B8 B8 77 D1 22 80 ....N..M....w.".

0030: 07 21 6F B1 5B F4 66 54C5 83 F6 E7 3F 3B 11 C3 .!o.[.fT....?;..

0040: 88 04 06 B1 8A 83 2C 89C1 F1 A0 03 A5 1E 68 24 ......,.......h$

0050: 7A DA 23 CA 8C 9D E6 BF89 3B CE F7 7D 99 33 53 z.#......;....3S

0060: F5 01 95 CB 94 72 45 7DE4 31 82 64 7A 2E 4A 66 .....rE..1.dz.Jf

0070: DE 02 44 1E 88 49 82 0040 F2 C3 E1 2C 8B 34 EB ..D..I..@...,.4.

]

main, READ: SSLv3 Handshake, length = 4

*** ServerHelloDone

*** ClientKeyExchange, RSA PreMasterSecret, SSLv3

Random Secret: { 3, 0, 102, 192, 44, 228, 57, 178, 251, 179, 238, 49, 40,

192, 94, 104, 62, 103, 186, 90, 54, 20, 167, 175, 134,

167, 144, 65, 21, 175, 156, 2, 119, 222, 193, 28, 68,

173, 177, 14, 150, 121, 94, 48, 233, 235, 84, 30 }

main, WRITE: SSLv3 Handshake, length = 132

SESSION KEYGEN:

PreMaster Secret:

0000: 03 00 66 C0 2C E4 39 B2FB B3 EE 31 28 C0 5E 68 ..f.,.9....1(.^h

0010: 3E 67 BA 5A 36 14 A7 AF86 A7 90 41 15 AF 9C 02 >g.Z6......A....

0020: 77 DE C1 1C 44 AD B1 0E96 79 5E 30 E9 EB 54 1E w...D....y^0..T.

CONNECTION KEYGEN:

Client Nonce:

0000: 44 71 80 18 99 CF B4 E575 7A 72 B4 50 64 B1 EE Dq......uzr.Pd..

0010: 60 BB 35 BF 17 A6 B1 926D 8F D4 8A 56 FE FD 2D `.5.....m...V..-

Server Nonce:

0000: 44 71 80 18 1B DD A4 2DF1 C8 AF 7E 71 B7 6E CB Dq.....-....q.n.

0010: 69 24 F3 D0 1A E9 B5 B969 D9 26 4B 75 B9 9B C3 i$......i.&Ku...

Master Secret:

0000: 47 48 2B 6F 03 40 CA 0EF6 E3 D0 47 2F FB BA A4 GH+o.@.....G/...

0010: B3 E6 CB FE 0F A3 A3 4C17 FD 70 3E D4 34 0F C9 .......L..p>.4..

0020: 0C 05 B4 46 A3 F3 54 ADC6 E9 C5 BB 1D 1E BB 37 ...F..T........7

Client MAC write Secret:

0000: 4B 25 95 45 47 AD 0A EE3F 7A C5 64 F7 80 88 95 K%.EG...?z.d....

Server MAC write Secret:

0000: 2C CF 2E DC 3B E9 15 5CD4 F4 1C BF 17 2A 11 ED ,...;..\.....*..

Client write key:

0000: E1 6E 4A 61 77 9F 5D 4FF3 91 CE BE 21 A6 31 70 .nJaw.]O....!.1p

Server write key:

0000: 11 F4 45 C8 E4 EA B4 B598 39 32 62 30 02 0D C5 ..E......92b0...

... no IV for cipher

main, WRITE: SSLv3 Change Cipher Spec, length = 1

*** Finished

verify_data: { 237, 135, 50, 1, 17, 138, 99, 246, 119, 199, 132, 146, 8,

51, 217, 227, 107, 206, 37, 254, 45, 172, 37, 146, 201, 43,

68, 41, 150, 13, 200, 44, 131, 126, 186, 252 }

***

main, WRITE: SSLv3 Handshake, length = 56

main, READ: SSLv3 Alert, length = 2

main, RECV SSLv3 ALERT: fatal, bad_record_mac

main, called closeSocket()

main, handling exception: javax.net.ssl.SSLException: Received fatal alert: bad_record_mac

javax.net.ssl.SSLException: Received fatal alert: bad_record_mac

at com.sun.net.ssl.internal.ssl.Alerts.

getSSLException(Alerts.java:166)

getSSLException(Alerts.java:117)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.

recvAlert(SSLSocketImpl.java:1542)

readRecord(SSLSocketImpl.java:863)

performInitialHandshake(SSLSocketImpl.java:1025)

startHandshake(SSLSocketImpl.java:1038)

at sun.net.www.protocol.https.HttpsClient

afterConnect(HttpsClient.java:402)

at sun.net.www.protocol.httpsbstractDelegateHttpsURLConnection

connect(AbstractDelegateHttpsURLConnection.java:170)

at sun.net.www.protocol.http.HttpURLConnection

getInputStream(HttpURLConnection.java:913)

at java.net.URLConnection.getContent(URLConnection.java:682)

at sun.net.www.protocol.https.HttpsURLConnectionImpl

getContent(HttpsURLConnectionImpl.java:406)

at com.glowria.https.TestHttpsClient.testURL(TestHttpsClient.java:51)

at com.glowria.https.TestHttpsClient.main(TestHttpsClient.java:42)

(used a smaller text)

Message was edited by:

Baldurien

Balduriena at 2007-7-13 22:35:45 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 2

I tried a new https server, which works there :

setting up default SSLSocketFactory

use default SunJSSE impl class: com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl

class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl is loaded

keyStore is :

keyStore type is : jks

keyStore provider is :

init keystore

init keymanager of type SunX509

trustStore is: C:\Documents and Settings\glhez\.keystore

trustStore type is : jks

trustStore provider is :

init truststore

adding as trusted cert:

Subject: EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=mailetud.univ-mlv.fr,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

ST=Ile de France, C=FR

Issuer: EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=etudiant CA,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

L=Champs-sur-Marne - Marne-la-Vallee, ST=Ile de France, C=FR

Algorithm: RSA; Serial number: 0x1

Valid from Mon Oct 27 16:29:06 CET 2003 until Wed Oct 26 17:29:06 CEST 2005

adding as trusted cert:

Subject: CN=www.glowria.fr, O=glow entertainment group, L=paris, ST=idf, C=FR

Issuer: EMAILADDRESS=premium-server@thawte.com, CN=Thawte Premium Server CA,

OU=Certification Services Division, O=Thawte Consulting cc, L=Cape Town,

ST=Western Cape, C=ZA

Algorithm: RSA; Serial number: 0x1de258b0fdc72c97ffea9e6aaa029200

Valid from Wed Apr 05 17:15:56 CEST 2006 until Thu Apr 05 17:15:56 CEST 2007

init context

trigger seeding of SecureRandom

done seeding SecureRandom

instantiated an instance of class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl

%% No cached client session

*** ClientHello, TLSv1

RandomCookie: GMT: 1148223534 bytes = { 186, 230, 42, 186, 223, 84, 115, 187,

216, 46, 235, 141, 239, 134, 217, 148, 74, 157, 173, 74, 130, 56, 152, 134, 99,

254, 1, 71 }

Session ID: {}

Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,

TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,

TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,

SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,

SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,

SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,

SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,

SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]

Compression Methods: { 0 }

***

main, WRITE: TLSv1 Handshake, length = 73

main, WRITE: SSLv2 client hello message, length = 98

main, READ: TLSv1 Handshake, length = 74

*** ServerHello, TLSv1

RandomCookie: GMT: 1148223526 bytes = { 69, 189, 250, 58, 27, 74, 130, 198,

50, 83, 226, 179, 175, 131, 104, 32, 114, 88, 134, 172, 20, 175, 246, 104,

26, 251, 193, 50 }

Session ID: {28, 235, 80, 245, 224, 143, 21, 124, 122, 115, 186, 196, 139,

153, 46, 192, 17, 65, 197, 206, 225, 102, 2, 215, 113, 63, 251, 20, 131,

196, 55, 201}

Cipher Suite: SSL_RSA_WITH_RC4_128_MD5

Compression Method: 0

***

%% Created: [Session-1, SSL_RSA_WITH_RC4_128_MD5]

** SSL_RSA_WITH_RC4_128_MD5

main, READ: TLSv1 Handshake, length = 1192

*** Certificate chain

chain [0] = [

[

Version: V3

Subject: EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=mailetud.univ-mlv.fr,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

ST=Ile de France, C=FR

Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4

Key: Sun RSA public key, 1024 bits

modulus: 1426251829661982714148805904206942750000497998823769346392663954

1204428676516876891211809926501034389052735166176875218875641576

4266364163386542249716717454793591475095097171319107364031493713

8335248363227380494337919981953710847348047053640676847818020310

51714690546818017594341685492788286410213828629982987

public exponent: 65537

Validity: [From: Mon Oct 27 16:29:06 CET 2003,

To: Wed Oct 26 17:29:06 CEST 2005]

Issuer: EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=etudiant CA,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

L=Champs-sur-Marne - Marne-la-Vallee, ST=Ile de France, C=FR

SerialNumber: [01]

Certificate Extensions: 4

[1]: ObjectId: 2.16.840.1.113730.1.13 Criticality=false

Extension unknown: DER encoded OCTET string =

0000: 04 1F 16 1D 4F 70 65 6E53 53 4C 20 47 65 6E 65 ....OpenSSL Gene

0010: 72 61 74 65 64 20 43 6572 74 69 66 69 63 61 74 rated Certificat

0020: 65 e

[2]: ObjectId: 2.5.29.14 Criticality=false

SubjectKeyIdentifier [

KeyIdentifier [

0000: EB AB 16 5E 52 8D 9B FC69 A2 A8 66 FA 74 BC EF ...^R...i..f.t..

0010: C8 B9 4D B2..M.

]

]

[3]: ObjectId: 2.5.29.35 Criticality=false

AuthorityKeyIdentifier [

KeyIdentifier [

0000: FF F9 71 FD 8A 51 B7 DF98 D8 FA 16 9A C4 2D 75 ..q..Q........-u

0010: 38 BD 95 028...

]

[EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=etudiant CA,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

L=Champs-sur-Marne - Marne-la-Vallee, ST=Ile de France, C=FR]

SerialNumber: [00]

]

[4]: ObjectId: 2.5.29.19 Criticality=false

BasicConstraints:[

CA:false

PathLen: undefined

]

]

Algorithm: [MD5withRSA]

Signature:

0000: 8F B7 9D 16 F3 24 48 12DE 1D 31 8F 59 B1 04 2B .....$H...1.Y..+

0010: B3 34 4E 05 96 EB E5 17D2 3C D4 39 31 8F FC BB .4N......<.91...

0020: D0 3A FC D0 F6 3A F9 58E4 0B AD 09 E5 F5 32 DE .:...:.X......2.

0030: 0F 70 4D E3 C8 B0 75 3EE7 98 C8 56 EE 99 FE 65 .pM...u>...V...e

0040: 40 18 A5 A4 5A 9C 97 4BFA 85 AD 72 5F F1 F4 95 @...Z..K...r_...

0050: 96 2E 4B 8D EE 70 B2 FD0D 92 BB 2A 49 21 85 13 ..K..p.....*I!..

0060: D1 4D 33 48 8C 24 CE 21BA 66 CB 2A 2A 38 6F B2 .M3H.$.!.f.**8o.

0070: 06 68 98 DD 73 F1 3B 330D 9C BF F0 02 70 BE D2 .h..s.;3.....p..

]

***

Found trusted certificate:

[

[

Version: V3

Subject: EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=mailetud.univ-mlv.fr,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

ST=Ile de France, C=FR

Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4

Key: Sun RSA public key, 1024 bits

modulus: 142625182966198271414880590420694275000049799882376934639266395412

044286765168768912118099265010343890527351661768752188756415764266

364163386542249716717454793591475095097171319107364031493713833524

836322738049433791998195371084734804705364067684781802031051714690

546818017594341685492788286410213828629982987

public exponent: 65537

Validity: [From: Mon Oct 27 16:29:06 CET 2003,

To: Wed Oct 26 17:29:06 CEST 2005]

Issuer: EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=etudiant CA,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

L=Champs-sur-Marne - Marne-la-Vallee, ST=Ile de France, C=FR

SerialNumber: [01]

Certificate Extensions: 4

[1]: ObjectId: 2.16.840.1.113730.1.13 Criticality=false

Extension unknown: DER encoded OCTET string =

0000: 04 1F 16 1D 4F 70 65 6E53 53 4C 20 47 65 6E 65 ....OpenSSL Gene

0010: 72 61 74 65 64 20 43 6572 74 69 66 69 63 61 74 rated Certificat

0020: 65 e

[2]: ObjectId: 2.5.29.14 Criticality=false

SubjectKeyIdentifier [

KeyIdentifier [

0000: EB AB 16 5E 52 8D 9B FC69 A2 A8 66 FA 74 BC EF ...^R...i..f.t..

0010: C8 B9 4D B2..M.

]

]

[3]: ObjectId: 2.5.29.35 Criticality=false

AuthorityKeyIdentifier [

KeyIdentifier [

0000: FF F9 71 FD 8A 51 B7 DF98 D8 FA 16 9A C4 2D 75 ..q..Q........-u

0010: 38 BD 95 028...

]

[EMAILADDRESS=root@etudiant.univ-mlv.fr, CN=etudiant CA,

OU=Centre de Ressources Informatiques, O=Universite de Marne-la-Vallee,

L=Champs-sur-Marne - Marne-la-Vallee, ST=Ile de France, C=FR]

SerialNumber: [00]

]

[4]: ObjectId: 2.5.29.19 Criticality=false

BasicConstraints:[

CA:false

PathLen: undefined

]

]

Algorithm: [MD5withRSA]

Signature:

0000: 8F B7 9D 16 F3 24 48 12DE 1D 31 8F 59 B1 04 2B .....$H...1.Y..+

0010: B3 34 4E 05 96 EB E5 17D2 3C D4 39 31 8F FC BB .4N......<.91...

0020: D0 3A FC D0 F6 3A F9 58E4 0B AD 09 E5 F5 32 DE .:...:.X......2.

0030: 0F 70 4D E3 C8 B0 75 3EE7 98 C8 56 EE 99 FE 65 .pM...u>...V...e

0040: 40 18 A5 A4 5A 9C 97 4BFA 85 AD 72 5F F1 F4 95 @...Z..K...r_...

0050: 96 2E 4B 8D EE 70 B2 FD0D 92 BB 2A 49 21 85 13 ..K..p.....*I!..

0060: D1 4D 33 48 8C 24 CE 21BA 66 CB 2A 2A 38 6F B2 .M3H.$.!.f.**8o.

0070: 06 68 98 DD 73 F1 3B 330D 9C BF F0 02 70 BE D2 .h..s.;3.....p..

]

main, READ: TLSv1 Handshake, length = 4

*** ServerHelloDone

*** ClientKeyExchange, RSA PreMasterSecret, TLSv1

Random Secret: { 3, 1, 56, 136, 243, 171, 108, 77, 86, 161, 154, 59,

19, 13, 49, 62, 33, 148, 24, 42, 168, 66, 65, 212, 147, 142, 198, 11,

59, 52, 177, 141, 83, 126, 5, 18, 35, 105, 245, 27, 62, 62, 129, 138,

102, 252, 81, 58 }

main, WRITE: TLSv1 Handshake, length = 134

SESSION KEYGEN:

PreMaster Secret:

0000: 03 01 38 88 F3 AB 6C 4D56 A1 9A 3B 13 0D 31 3E ..8...lMV..;..1>

0010: 21 94 18 2A A8 42 41 D493 8E C6 0B 3B 34 B1 8D !..*.BA.....;4..

0020: 53 7E 05 12 23 69 F5 1B3E 3E 81 8A 66 FC 51 3A S...#i..>>..f.Q:

CONNECTION KEYGEN:

Client Nonce:

0000: 44 71 80 2E BA E6 2A BADF 54 73 BB D8 2E EB 8D Dq....*..Ts.....

0010: EF 86 D9 94 4A 9D AD 4A82 38 98 86 63 FE 01 47 ....J..J.8..c..G

Server Nonce:

0000: 44 71 80 26 45 BD FA 3A1B 4A 82 C6 32 53 E2 B3 Dq.&E..:.J..2S..

0010: AF 83 68 20 72 58 86 AC14 AF F6 68 1A FB C1 32 ..h rX.....h...2

Master Secret:

0000: 25 3A 0B D5 E4 F2 4C 3729 00 72 C6 8F 7D 8A B7 %:....L7).r.....

0010: 6A 6F E7 FE F6 96 9D 274E D5 CD 83 7A 29 36 3E jo.....'N...z)6>

0020: 58 D1 94 93 A4 DA EA 9DF4 E7 BD 2B 5D 80 14 18 X..........+]...

Client MAC write Secret:

0000: 26 C5 7F E0 1C E7 D5 F214 2A 79 9B 19 1E 17 CF &........*y.....

Server MAC write Secret:

0000: 77 D3 16 41 D2 33 83 37C9 56 E5 6A 79 0D 4D CF w..A.3.7.V.jy.M.

Client write key:

0000: E3 97 2D 4A 23 4C DB D595 3F B2 52 07 9D 18 25 ..-J#L...?.R...%

Server write key:

0000: 73 85 00 B4 C6 AA 38 FCE3 22 B2 80 8F C5 CA 26 s.....8..".....&

... no IV for cipher

main, WRITE: TLSv1 Change Cipher Spec, length = 1

*** Finished

verify_data: { 76, 165, 19, 71, 250, 53, 58, 151, 147, 240, 12, 185 }

***

main, WRITE: TLSv1 Handshake, length = 32

main, READ: TLSv1 Change Cipher Spec, length = 1

main, READ: TLSv1 Handshake, length = 32

*** Finished

verify_data: { 95, 255, 245, 180, 91, 115, 1, 2, 46, 162, 34, 116 }

***

%% Cached client session: [Session-1, SSL_RSA_WITH_RC4_128_MD5]

main, WRITE: TLSv1 Application Data, length = 224

main, READ: TLSv1 Application Data, length = 386

main, called close()

main, called closeInternal(true)

main, SEND TLSv1 ALERT: warning, description = close_notify

main, WRITE: TLSv1 Alert, length = 18

%% Client cached [Session-1, SSL_RSA_WITH_RC4_128_MD5]

%% Try resuming [Session-1, SSL_RSA_WITH_RC4_128_MD5] from port 1462

*** ClientHello, TLSv1

RandomCookie: GMT: 1148223534 bytes = { 11, 88, 61, 60, 137, 15, 11,

168, 161, 15, 50, 61, 242, 52, 224, 24, 153, 200, 175, 143, 208, 80,

175, 178, 124, 254, 96, 110 }

Session ID: {28, 235, 80, 245, 224, 143, 21, 124, 122, 115, 186,

196, 139, 153, 46, 192, 17, 65, 197, 206, 225, 102, 2, 215, 113, 63,

251, 20, 131, 196, 55, 201}

Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,

TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,

TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,

SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,

SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,

SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,

SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,

SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]

Compression Methods: { 0 }

***

main, WRITE: TLSv1 Handshake, length = 105

main, READ: TLSv1 Handshake, length = 74

*** ServerHello, TLSv1

RandomCookie: GMT: 1148223527 bytes = { 119, 68, 218, 177, 246, 160, 199,

187, 195, 202, 9, 1, 79, 68, 117, 237, 224, 41, 39, 83, 166, 69, 62, 10,

103, 87, 108, 102 }

Session ID: {28, 235, 80, 245, 224, 143, 21, 124, 122, 115, 186, 196, 139,

153, 46, 192, 17, 65, 197, 206, 225, 102, 2, 215, 113, 63, 251, 20, 131,

196, 55, 201}

Cipher Suite: SSL_RSA_WITH_RC4_128_MD5

Compression Method: 0

***

CONNECTION KEYGEN:

Client Nonce:

0000: 44 71 80 2E 0B 58 3D 3C89 0F 0B A8 A1 0F 32 3D Dq...X=<......2=

0010: F2 34 E0 18 99 C8 AF 8FD0 50 AF B2 7C FE 60 6E .4.......P....`n

Server Nonce:

0000: 44 71 80 27 77 44 DA B1F6 A0 C7 BB C3 CA 09 01 Dq.'wD..........

0010: 4F 44 75 ED E0 29 27 53A6 45 3E 0A 67 57 6C 66 ODu..)'S.E>.gWlf

Master Secret:

0000: 25 3A 0B D5 E4 F2 4C 3729 00 72 C6 8F 7D 8A B7 %:....L7).r.....

0010: 6A 6F E7 FE F6 96 9D 274E D5 CD 83 7A 29 36 3E jo.....'N...z)6>

0020: 58 D1 94 93 A4 DA EA 9DF4 E7 BD 2B 5D 80 14 18 X..........+]...

Client MAC write Secret:

0000: 44 30 B4 A6 C7 85 D2 6DBD 1D 7F FD 73 7B B7 8D D0.....m....s...

Server MAC write Secret:

0000: 46 03 97 68 F5 B8 FE 0127 09 F0 91 10 8C 6F 27 F..h....'.....o'

Client write key:

0000: 64 E2 4F FB 48 A8 A7 AB5F 95 FA 4D 77 EC 82 DB d.O.H..._..Mw...

Server write key:

0000: 37 68 A5 3D 3C DE 4A 6C63 A2 7A 72 A7 46 22 50 7h.=<.Jlc.zr.F"P

... no IV for cipher

%% Server resumed [Session-1, SSL_RSA_WITH_RC4_128_MD5]

main, READ: TLSv1 Change Cipher Spec, length = 1

main, READ: TLSv1 Handshake, length = 32

*** Finished

verify_data: { 144, 93, 172, 212, 96, 148, 245, 121, 186, 131, 11, 193 }

***

main, WRITE: TLSv1 Change Cipher Spec, length = 1

*** Finished

verify_data: { 143, 95, 35, 251, 140, 78, 67, 197, 94, 200, 26, 118 }

***

main, WRITE: TLSv1 Handshake, length = 32

main, WRITE: TLSv1 Application Data, length = 237

main, READ: TLSv1 Application Data, length = 2964

I think the problem is within the handshake, but I'm not specialised in SSL, and the doc I read does not help me :/

Balduriena at 2007-7-13 22:35:45 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 3
It's not the certificate, it's an incompatible SSL server at the other end in the case that doesn't work. What is it? It seems to be broken.
ejpa at 2007-7-13 22:35:45 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 4

Hi, and thanks for replying.

I found that is was due to the protocol :

SSLSocket socket = (SSLSocket) SSLSocketFactory.getDefault().createSocket(

HTTPS_SERVER.substring("https://".length()), 443);

//socket.setEnabledProtocols(new String[] {

//"SSLv3"

//});

socket.startHandshake();

socket.getOutputStream().write("GET / HTTP/1.0\r\n\r\n".getBytes("ASCII"));

Scanner sc = new Scanner(socket.getInputStream());

System.out.println(">>>");

while (sc.hasNextLine())

System.out.println(sc.nextLine());

System.out.println("<<<");

This code will not work except if I uncomment.

What I seek now is a way to use only that protocol (sslv3) and not another, so that it works for my case.

http://java.sun.com/j2se/1.5.0/docs/guide/security/jsse/JSSERefGuide.html#InstallationAndCustomization

This speak about https.protocols property, but it does not seems to work with secure socket (so the given example will fail)

Balduriena at 2007-7-13 22:35:45 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 5
You've found the only way I'm aware of, or maybe SSLContext.getInstance("SSLv3") and so forth.https.protocols works only for https: URLs.
ejpa at 2007-7-13 22:35:45 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 6

Geez.

That won't help me.

Anyway, I created a socket factory which delegate to com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl the creation of socket, and I call setEnabledProtocols behind each socket creation.

I think it's possible to override the default socket factory, which would be easyer than using the bootstrap to override the default factory.

Balduriena at 2007-7-13 22:35:45 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 7
But surely you don't need to delegate to a sun.* class, just to SSLSocketFactory.getDefault(), and modify the protocols of the result before you return it.
ejpa at 2007-7-13 22:35:45 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 8
well finally -Dhttps.protocols=SSLv3,SSLv2Hello -Dssl.SocketFactory.provider=com.glowria.https.SSLv3SocketFactoryWorks fine :)
Balduriena at 2007-7-13 22:35:45 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
Security
Java Secure Socket Extension (JSSE)

Security New Topic

Security Hot Topic

Security

All Classified