Groups > comp.lang.java.programmer > #32157 > unrolled thread

netty with ssl

Started by	Louie <liuhongyuand@gmail.com>
First post	2015-07-27 03:33 -0700
Last post	2016-03-02 09:53 -0800
Articles	9 — 4 participants

Back to article view | Back to comp.lang.java.programmer

  netty with ssl Louie <liuhongyuand@gmail.com> - 2015-07-27 03:33 -0700
    Re: netty with ssl Eric Sosman <esosman@comcast-dot-net.invalid> - 2015-07-27 07:45 -0400
      Re: netty with ssl Louie <liuhongyuand@gmail.com> - 2015-07-27 05:45 -0700
        Re: netty with ssl e.d.programmer@gmail.com - 2015-07-27 06:26 -0700
          Re: netty with ssl Eric Sosman <esosman@comcast-dot-net.invalid> - 2015-07-27 09:53 -0400
            Re: netty with ssl e.d.programmer@gmail.com - 2015-07-27 08:09 -0700
    Re: netty with ssl Louie <liuhongyuand@gmail.com> - 2015-07-28 00:10 -0700
      Re: netty with ssl e.d.programmer@gmail.com - 2015-07-28 05:44 -0700
    Re: netty with ssl phalgun251@gmail.com - 2016-03-02 09:53 -0800

#32157 — netty with ssl

From	Louie <liuhongyuand@gmail.com>
Date	2015-07-27 03:33 -0700
Subject	netty with ssl
Message-ID	<7224870d-053b-449f-84a5-61e31af54cc6@googlegroups.com>

Hi
 I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.

error code:
  adding as trusted cert:
  Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
  Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
  Algorithm: RSA; Serial number: 0xffc3decf334dd844
  Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025

trigger seeding of SecureRandom
done seeding SecureRandom
NewsInterface server listening on port 443
Using SSLEngineImpl.
Using SSLEngineImpl.
Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
.
.
.
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
.
.
Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256

nioEventLoopGroup-3-2, READ: TLSv1 Handshake, length = 201
*** ClientHello, TLSv1.2
*** ClientHello, TLSv1.2
RandomCookie:  RandomCookie:  GMT: 17143111 GMT: 76079028 bytes = { bytes = { 24147, , 165, 240, 26, 239, 99, 4, 230, 85, 246, 75, 36, 214, 149, 50, 109, 187, 118, 217, 152, 174, 60, 99, 181, 31, 202, 118, 201, 2, 178, 239, 249, 62, 162, 203, 203, 50, 131, 198, 170, 255, 215, 38, 231, 182, 4, 208, 243, 80, 235, 159117,  }
4, Session ID:  140, {}
Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
Unsupported extension type_23, data: 
Unsupported extension type_35, data: 
Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
Unsupported extension status_request, data: 01:00:00:00:00
Unsupported extension type_13172, data: 
Unsupported extension type_18, data: 
Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
Unsupported extension type_30032, data: 
Extension ec_point_formats, formats: [uncompressed]
Extension elliptic_curves, curve names: {secp256r1, secp384r1}
***
86 }
Session ID:  {}
Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
Unsupported extension type_23, data: 
%% Initialized:  [Session-1, SSL_NULL_WITH_NULL_NULL]
Unsupported extension type_35, data: 
Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
Unsupported extension status_request, data: 01:00:00:00:00
Unsupported extension type_13172, data: 
Unsupported extension type_18, data: 
Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
Unsupported extension type_30032, data: 
Extension ec_point_formats, formats: [uncompressed]
Extension elliptic_curves, curve names: {secp256r1, secp384r1}
***
%% Initialized:  [Session-2, SSL_NULL_WITH_NULL_NULL]
nioEventLoopGroup-3-1, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated:  [Session-1, SSL_NULL_WITH_NULL_NULL]
nioEventLoopGroup-3-1, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
nioEventLoopGroup-3-2, fatal error: 40: no cipher suites in common
javax.net.ssl.SSLHandshakeException: no cipher suites in common
%% Invalidated:  [Session-2, SSL_NULL_WITH_NULL_NULL]
nioEventLoopGroup-3-2, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
nioEventLoopGroup-3-2, WRITE: TLSv1.2 Alert, length = 2
nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
nioEventLoopGroup-3-2, called closeOutbound()
nioEventLoopGroup-3-2, closeOutboundInternal()
nioEventLoopGroup-3-1, WRITE: TLSv1.2 Alert, length = 2
nioEventLoopGroup-3-2, called closeInbound()
nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
nioEventLoopGroup-3-1, called closeOutbound()
nioEventLoopGroup-3-1, closeOutboundInternal()
nioEventLoopGroup-3-1, called closeInbound()
nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.

Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.

nioEventLoopGroup-3-2, called closeOutbound()
nioEventLoopGroup-3-2, closeOutboundInternal()
nioEventLoopGroup-3-2, called closeInbound()
nioEventLoopGroup-3-2, closeInboundInternal()
nioEventLoopGroup-3-1, called closeOutbound()
nioEventLoopGroup-3-1, closeOutboundInternal()
nioEventLoopGroup-3-1, called closeInbound()
nioEventLoopGroup-3-1, closeInboundInternal()




ssl code:
            SSLContext context = null;
        try {
            context = SSLContext.getInstance("TLS");
            TrustManagerFactory tmf;
            KeyStore ks = KeyStore.getInstance("JKS");
            ks.load(new FileInputStream(System.getProperty("user.dir") + "/cer/cacerts.jks"), password);
            tmf = TrustManagerFactory.getInstance("SunX509");
            tmf.init(ks);
            TrustManager[] tm = tmf.getTrustManagers();
            context.init(null,tm, null);
        } catch (CertificateException | NoSuchAlgorithmException | KeyStoreException | IOException | KeyManagementException e) {
            e.printStackTrace();
        }

                        SSLEngine sslEngine = sslContext.createSSLEngine();
			sslEngine.setUseClientMode(false);
			SslHandler sslHandler = new SslHandler(sslEngine);
			pipeline.addLast("ssl",sslHandler);



Why it doesn't work? Please help me,thanks!

[toc] | [next] | [standalone]

#32158

From	Eric Sosman <esosman@comcast-dot-net.invalid>
Date	2015-07-27 07:45 -0400
Message-ID	<mp55hl$an9$1@dont-email.me>
In reply to	#32157

On 7/27/2015 6:33 AM, Louie wrote:
> Hi
>   I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.
>
> error code:
>    adding as trusted cert:
>    Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>    Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>    Algorithm: RSA; Serial number: 0xffc3decf334dd844
>    Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025
> [...]

     Just a wild guess, because I know little or nothing about this
stuff, BUT: Have you noticed that "Mon Jul 27 17:05:34 CST" is in
the future (as of your post at "Mon, 27 Jul 2015 03:33:39 -0700 (PDT)")?
That is, perhaps your authentication failed because the certificate was
not yet valid!  If so, maybe things will start working if you wait a
few more hours.

     Or maybe not -- Remember, I said "wild guess."

-- 
esosman@comcast-dot-net.invalid
"Don't be afraid of work. Make work afraid of you." -- TLM

[toc] | [prev] | [next] | [standalone]

#32160

From	Louie <liuhongyuand@gmail.com>
Date	2015-07-27 05:45 -0700
Message-ID	<0984fdc3-6cbb-4c3a-92c9-9ee4053edc67@googlegroups.com>
In reply to	#32158

在 2015年7月27日星期一 UTC+8下午7:45:35，Eric Sosman写道：
> On 7/27/2015 6:33 AM, Louie wrote:
> > Hi
> >   I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.
> >
> > error code:
> >    adding as trusted cert:
> >    Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
> >    Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
> >    Algorithm: RSA; Serial number: 0xffc3decf334dd844
> >    Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025
> > [...]
> 
>      Just a wild guess, because I know little or nothing about this
> stuff, BUT: Have you noticed that "Mon Jul 27 17:05:34 CST" is in
> the future (as of your post at "Mon, 27 Jul 2015 03:33:39 -0700 (PDT)")?
> That is, perhaps your authentication failed because the certificate was
> not yet valid!  If so, maybe things will start working if you wait a
> few more hours.
> 
>      Or maybe not -- Remember, I said "wild guess."
> 
> -- 
> esosman@comcast-dot-net.invalid
> "Don't be afraid of work. Make work afraid of you." -- TLM

Thanks for your help, because I'm in China, the time will different from you.

[toc] | [prev] | [next] | [standalone]

#32161

From	e.d.programmer@gmail.com
Date	2015-07-27 06:26 -0700
Message-ID	<e6b9ed5d-b489-4f03-9d77-586ddacac82e@googlegroups.com>
In reply to	#32160

On Monday, July 27, 2015 at 8:45:19 AM UTC-4, Louie wrote:
> 在 2015年7月27日星期一 UTC+8下午7:45:35，Eric Sosman写道：
> > On 7/27/2015 6:33 AM, Louie wrote:
> > > Hi
> > >   I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.
> > >
> > > error code:
> > >    adding as trusted cert:
> > >    Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
> > >    Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
> > >    Algorithm: RSA; Serial number: 0xffc3decf334dd844
> > >    Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025
> > > [...]
> > 
> >      Just a wild guess, because I know little or nothing about this
> > stuff, BUT: Have you noticed that "Mon Jul 27 17:05:34 CST" is in
> > the future (as of your post at "Mon, 27 Jul 2015 03:33:39 -0700 (PDT)")?
> > That is, perhaps your authentication failed because the certificate was
> > not yet valid!  If so, maybe things will start working if you wait a
> > few more hours.
> > 
> >      Or maybe not -- Remember, I said "wild guess."
> > 
> > -- 
> > esosman@comcast-dot-net.invalid
> > "Don't be afraid of work. Make work afraid of you." -- TLM
> 
> Thanks for your help, because I'm in China, the time will different from you.

Today is Monday in North America.  Assuming the 17:05:34 is hours:minutes:seconds, the time is still future.  Time is the same everywhere when you reference time zone (CST), though offhand I don't think that's your problem, or only problem.

[toc] | [prev] | [next] | [standalone]

#32162

From	Eric Sosman <esosman@comcast-dot-net.invalid>
Date	2015-07-27 09:53 -0400
Message-ID	<mp5d2i$6hn$1@dont-email.me>
In reply to	#32161

On 7/27/2015 9:26 AM, e.d.programmer@gmail.com wrote:
> On Monday, July 27, 2015 at 8:45:19 AM UTC-4, Louie wrote:
>> 在 2015年7月27日星期一 UTC+8下午7:45:35，Eric Sosman写道：
>>> On 7/27/2015 6:33 AM, Louie wrote:
>>>> Hi
>>>>    I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.
>>>>
>>>> error code:
>>>>     adding as trusted cert:
>>>>     Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>>>>     Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>>>>     Algorithm: RSA; Serial number: 0xffc3decf334dd844
>>>>     Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025
>>>> [...]
>>>
>>>       Just a wild guess, because I know little or nothing about this
>>> stuff, BUT: Have you noticed that "Mon Jul 27 17:05:34 CST" is in
>>> the future (as of your post at "Mon, 27 Jul 2015 03:33:39 -0700 (PDT)")?
>>> That is, perhaps your authentication failed because the certificate was
>>> not yet valid!  If so, maybe things will start working if you wait a
>>> few more hours.
>>>
>>>       Or maybe not -- Remember, I said "wild guess."
>>
>> Thanks for your help, because I'm in China, the time will different from you.
>
> Today is Monday in North America.  Assuming the 17:05:34 is hours:minutes:seconds, the time is still future.  Time is the same everywhere when you reference time zone (CST), though offhand I don't think that's your problem, or only problem.

     17:05:34 Monday in China Standard Time (UTC+8:00) was 09:05:34 UTC,
or 05:05:34 Eastern Daylight Time (UTC-4:00), or 02:05:34 Pacific
Daylight Time (UTC-7:00), all well before the time stamp of the original
posting.

     It's too bad that the error message used the ambiguous "CST" without
an accompanying "UTC+8:00" to avoid confusion.

-- 
esosman@comcast-dot-net.invalid
"Don't be afraid of work. Make work afraid of you." -- TLM

[toc] | [prev] | [next] | [standalone]

#32163

From	e.d.programmer@gmail.com
Date	2015-07-27 08:09 -0700
Message-ID	<fbbe5231-a76b-4d39-abdb-ae4b439959e8@googlegroups.com>
In reply to	#32162

On Monday, July 27, 2015 at 9:54:02 AM UTC-4, Eric Sosman wrote:
>      It's too bad that the error message used the ambiguous "CST" without
> an accompanying "UTC+8:00" to avoid confusion.
> 
> -- 
> esosman@comcast-dot-net.invalid
> "Don't be afraid of work. Make work afraid of you." -- TLM

That would make more sense if China refers to their UTC+8:00 as CST.  They really should be unique.  Around here CST is Central Standard Time (UTC - 6:00).
If you Google the error the first result does appear to have a likely solution.
http://stackoverflow.com/questions/15076820/java-sslhandshakeexception-no-cipher-suites-in-common

[toc] | [prev] | [next] | [standalone]

#32178

From	Louie <liuhongyuand@gmail.com>
Date	2015-07-28 00:10 -0700
Message-ID	<a5b0157c-ab68-4832-b9af-ec9105299591@googlegroups.com>
In reply to	#32157

在 2015年7月27日星期一 UTC+8下午6:34:04，Louie写道：
> Hi
>  I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.
> 
> error code:
>   adding as trusted cert:
>   Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>   Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>   Algorithm: RSA; Serial number: 0xffc3decf334dd844
>   Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025
> 
> trigger seeding of SecureRandom
> done seeding SecureRandom
> NewsInterface server listening on port 443
> Using SSLEngineImpl.
> Using SSLEngineImpl.
> Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
> Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
> .
> .
> .
> Allow unsafe renegotiation: false
> Allow legacy hello messages: true
> Is initial handshake: true
> Is secure renegotiation: false
> .
> .
> Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
> Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
> 
> nioEventLoopGroup-3-2, READ: TLSv1 Handshake, length = 201
> *** ClientHello, TLSv1.2
> *** ClientHello, TLSv1.2
> RandomCookie:  RandomCookie:  GMT: 17143111 GMT: 76079028 bytes = { bytes = { 24147, , 165, 240, 26, 239, 99, 4, 230, 85, 246, 75, 36, 214, 149, 50, 109, 187, 118, 217, 152, 174, 60, 99, 181, 31, 202, 118, 201, 2, 178, 239, 249, 62, 162, 203, 203, 50, 131, 198, 170, 255, 215, 38, 231, 182, 4, 208, 243, 80, 235, 159117,  }
> 4, Session ID:  140, {}
> Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
> Compression Methods:  { 0 }
> Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
> Unsupported extension type_23, data: 
> Unsupported extension type_35, data: 
> Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
> Unsupported extension status_request, data: 01:00:00:00:00
> Unsupported extension type_13172, data: 
> Unsupported extension type_18, data: 
> Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
> Unsupported extension type_30032, data: 
> Extension ec_point_formats, formats: [uncompressed]
> Extension elliptic_curves, curve names: {secp256r1, secp384r1}
> ***
> 86 }
> Session ID:  {}
> Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
> Compression Methods:  { 0 }
> Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
> Unsupported extension type_23, data: 
> %% Initialized:  [Session-1, SSL_NULL_WITH_NULL_NULL]
> Unsupported extension type_35, data: 
> Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
> Unsupported extension status_request, data: 01:00:00:00:00
> Unsupported extension type_13172, data: 
> Unsupported extension type_18, data: 
> Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
> Unsupported extension type_30032, data: 
> Extension ec_point_formats, formats: [uncompressed]
> Extension elliptic_curves, curve names: {secp256r1, secp384r1}
> ***
> %% Initialized:  [Session-2, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-1, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated:  [Session-1, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-1, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
> nioEventLoopGroup-3-2, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated:  [Session-2, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-2, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
> nioEventLoopGroup-3-2, WRITE: TLSv1.2 Alert, length = 2
> nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> nioEventLoopGroup-3-2, called closeOutbound()
> nioEventLoopGroup-3-2, closeOutboundInternal()
> nioEventLoopGroup-3-1, WRITE: TLSv1.2 Alert, length = 2
> nioEventLoopGroup-3-2, called closeInbound()
> nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
> nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> nioEventLoopGroup-3-1, called closeOutbound()
> nioEventLoopGroup-3-1, closeOutboundInternal()
> nioEventLoopGroup-3-1, called closeInbound()
> nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
> Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.
> 
> Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.
> 
> nioEventLoopGroup-3-2, called closeOutbound()
> nioEventLoopGroup-3-2, closeOutboundInternal()
> nioEventLoopGroup-3-2, called closeInbound()
> nioEventLoopGroup-3-2, closeInboundInternal()
> nioEventLoopGroup-3-1, called closeOutbound()
> nioEventLoopGroup-3-1, closeOutboundInternal()
> nioEventLoopGroup-3-1, called closeInbound()
> nioEventLoopGroup-3-1, closeInboundInternal()
> 
> 
> 
> 
> ssl code:
>             SSLContext context = null;
>         try {
>             context = SSLContext.getInstance("TLS");
>             TrustManagerFactory tmf;
>             KeyStore ks = KeyStore.getInstance("JKS");
>             ks.load(new FileInputStream(System.getProperty("user.dir") + "/cer/cacerts.jks"), password);
>             tmf = TrustManagerFactory.getInstance("SunX509");
>             tmf.init(ks);
>             TrustManager[] tm = tmf.getTrustManagers();
>             context.init(null,tm, null);
>         } catch (CertificateException | NoSuchAlgorithmException | KeyStoreException | IOException | KeyManagementException e) {
>             e.printStackTrace();
>         }
> 
>                         SSLEngine sslEngine = sslContext.createSSLEngine();
> 			sslEngine.setUseClientMode(false);
> 			SslHandler sslHandler = new SslHandler(sslEngine);
> 			pipeline.addLast("ssl",sslHandler);
> 
> 
> 
> Why it doesn't work? Please help me,thanks!

I'm still have this problem now...  please help me  T_T

[toc] | [prev] | [next] | [standalone]

#32181

From	e.d.programmer@gmail.com
Date	2015-07-28 05:44 -0700
Message-ID	<2acd3095-7153-45d7-b99e-bcfe3e825ffc@googlegroups.com>
In reply to	#32178

On Tuesday, July 28, 2015 at 3:11:17 AM UTC-4, Louie wrote:
> I'm still have this problem now...  please help me  T_T

Can you be more specific?  Have you checked the stackoverflow?  What have you tried to fix it?

[toc] | [prev] | [next] | [standalone]

#33913

From	phalgun251@gmail.com
Date	2016-03-02 09:53 -0800
Message-ID	<67048a95-a3c1-4c6f-a906-4223e2c5d0fa@googlegroups.com>
In reply to	#32157

On Monday, 27 July 2015 16:04:04 UTC+5:30, Louie  wrote:
> Hi
>  I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.
> 
> error code:
>   adding as trusted cert:
>   Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>   Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>   Algorithm: RSA; Serial number: 0xffc3decf334dd844
>   Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025
> 
> trigger seeding of SecureRandom
> done seeding SecureRandom
> NewsInterface server listening on port 443
> Using SSLEngineImpl.
> Using SSLEngineImpl.
> Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
> Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
> .
> .
> .
> Allow unsafe renegotiation: false
> Allow legacy hello messages: true
> Is initial handshake: true
> Is secure renegotiation: false
> .
> .
> Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
> Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
> 
> nioEventLoopGroup-3-2, READ: TLSv1 Handshake, length = 201
> *** ClientHello, TLSv1.2
> *** ClientHello, TLSv1.2
> RandomCookie:  RandomCookie:  GMT: 17143111 GMT: 76079028 bytes = { bytes = { 24147, , 165, 240, 26, 239, 99, 4, 230, 85, 246, 75, 36, 214, 149, 50, 109, 187, 118, 217, 152, 174, 60, 99, 181, 31, 202, 118, 201, 2, 178, 239, 249, 62, 162, 203, 203, 50, 131, 198, 170, 255, 215, 38, 231, 182, 4, 208, 243, 80, 235, 159117,  }
> 4, Session ID:  140, {}
> Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
> Compression Methods:  { 0 }
> Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
> Unsupported extension type_23, data: 
> Unsupported extension type_35, data: 
> Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
> Unsupported extension status_request, data: 01:00:00:00:00
> Unsupported extension type_13172, data: 
> Unsupported extension type_18, data: 
> Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
> Unsupported extension type_30032, data: 
> Extension ec_point_formats, formats: [uncompressed]
> Extension elliptic_curves, curve names: {secp256r1, secp384r1}
> ***
> 86 }
> Session ID:  {}
> Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
> Compression Methods:  { 0 }
> Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
> Unsupported extension type_23, data: 
> %% Initialized:  [Session-1, SSL_NULL_WITH_NULL_NULL]
> Unsupported extension type_35, data: 
> Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
> Unsupported extension status_request, data: 01:00:00:00:00
> Unsupported extension type_13172, data: 
> Unsupported extension type_18, data: 
> Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
> Unsupported extension type_30032, data: 
> Extension ec_point_formats, formats: [uncompressed]
> Extension elliptic_curves, curve names: {secp256r1, secp384r1}
> ***
> %% Initialized:  [Session-2, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-1, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated:  [Session-1, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-1, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
> nioEventLoopGroup-3-2, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated:  [Session-2, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-2, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
> nioEventLoopGroup-3-2, WRITE: TLSv1.2 Alert, length = 2
> nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> nioEventLoopGroup-3-2, called closeOutbound()
> nioEventLoopGroup-3-2, closeOutboundInternal()
> nioEventLoopGroup-3-1, WRITE: TLSv1.2 Alert, length = 2
> nioEventLoopGroup-3-2, called closeInbound()
> nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
> nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> nioEventLoopGroup-3-1, called closeOutbound()
> nioEventLoopGroup-3-1, closeOutboundInternal()
> nioEventLoopGroup-3-1, called closeInbound()
> nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
> Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.
> 
> Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.
> 
> nioEventLoopGroup-3-2, called closeOutbound()
> nioEventLoopGroup-3-2, closeOutboundInternal()
> nioEventLoopGroup-3-2, called closeInbound()
> nioEventLoopGroup-3-2, closeInboundInternal()
> nioEventLoopGroup-3-1, called closeOutbound()
> nioEventLoopGroup-3-1, closeOutboundInternal()
> nioEventLoopGroup-3-1, called closeInbound()
> nioEventLoopGroup-3-1, closeInboundInternal()
> 
> 
> 
> 
> ssl code:
>             SSLContext context = null;
>         try {
>             context = SSLContext.getInstance("TLS");
>             TrustManagerFactory tmf;
>             KeyStore ks = KeyStore.getInstance("JKS");
>             ks.load(new FileInputStream(System.getProperty("user.dir") + "/cer/cacerts.jks"), password);
>             tmf = TrustManagerFactory.getInstance("SunX509");
>             tmf.init(ks);
>             TrustManager[] tm = tmf.getTrustManagers();
>             context.init(null,tm, null);
>         } catch (CertificateException | NoSuchAlgorithmException | KeyStoreException | IOException | KeyManagementException e) {
>             e.printStackTrace();
>         }
> 
>                         SSLEngine sslEngine = sslContext.createSSLEngine();
> 			sslEngine.setUseClientMode(false);
> 			SslHandler sslHandler = new SslHandler(sslEngine);
> 			pipeline.addLast("ssl",sslHandler);
> 
> 
> 
> Why it doesn't work? Please help me,thanks!



On Monday, 27 July 2015 16:04:04 UTC+5:30, Louie  wrote:
> Hi
>  I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.
> 
> error code:
>   adding as trusted cert:
>   Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>   Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>   Algorithm: RSA; Serial number: 0xffc3decf334dd844
>   Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025
> 
> trigger seeding of SecureRandom
> done seeding SecureRandom
> NewsInterface server listening on port 443
> Using SSLEngineImpl.
> Using SSLEngineImpl.
> Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
> Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
> .
> .
> .
> Allow unsafe renegotiation: false
> Allow legacy hello messages: true
> Is initial handshake: true
> Is secure renegotiation: false
> .
> .
> Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
> Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
> 
> nioEventLoopGroup-3-2, READ: TLSv1 Handshake, length = 201
> *** ClientHello, TLSv1.2
> *** ClientHello, TLSv1.2
> RandomCookie:  RandomCookie:  GMT: 17143111 GMT: 76079028 bytes = { bytes = { 24147, , 165, 240, 26, 239, 99, 4, 230, 85, 246, 75, 36, 214, 149, 50, 109, 187, 118, 217, 152, 174, 60, 99, 181, 31, 202, 118, 201, 2, 178, 239, 249, 62, 162, 203, 203, 50, 131, 198, 170, 255, 215, 38, 231, 182, 4, 208, 243, 80, 235, 159117,  }
> 4, Session ID:  140, {}
> Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
> Compression Methods:  { 0 }
> Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
> Unsupported extension type_23, data: 
> Unsupported extension type_35, data: 
> Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
> Unsupported extension status_request, data: 01:00:00:00:00
> Unsupported extension type_13172, data: 
> Unsupported extension type_18, data: 
> Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
> Unsupported extension type_30032, data: 
> Extension ec_point_formats, formats: [uncompressed]
> Extension elliptic_curves, curve names: {secp256r1, secp384r1}
> ***
> 86 }
> Session ID:  {}
> Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
> Compression Methods:  { 0 }
> Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
> Unsupported extension type_23, data: 
> %% Initialized:  [Session-1, SSL_NULL_WITH_NULL_NULL]
> Unsupported extension type_35, data: 
> Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
> Unsupported extension status_request, data: 01:00:00:00:00
> Unsupported extension type_13172, data: 
> Unsupported extension type_18, data: 
> Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
> Unsupported extension type_30032, data: 
> Extension ec_point_formats, formats: [uncompressed]
> Extension elliptic_curves, curve names: {secp256r1, secp384r1}
> ***
> %% Initialized:  [Session-2, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-1, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated:  [Session-1, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-1, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
> nioEventLoopGroup-3-2, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated:  [Session-2, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-2, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
> nioEventLoopGroup-3-2, WRITE: TLSv1.2 Alert, length = 2
> nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> nioEventLoopGroup-3-2, called closeOutbound()
> nioEventLoopGroup-3-2, closeOutboundInternal()
> nioEventLoopGroup-3-1, WRITE: TLSv1.2 Alert, length = 2
> nioEventLoopGroup-3-2, called closeInbound()
> nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
> nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> nioEventLoopGroup-3-1, called closeOutbound()
> nioEventLoopGroup-3-1, closeOutboundInternal()
> nioEventLoopGroup-3-1, called closeInbound()
> nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
> Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.
> 
> Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.
> 
> nioEventLoopGroup-3-2, called closeOutbound()
> nioEventLoopGroup-3-2, closeOutboundInternal()
> nioEventLoopGroup-3-2, called closeInbound()
> nioEventLoopGroup-3-2, closeInboundInternal()
> nioEventLoopGroup-3-1, called closeOutbound()
> nioEventLoopGroup-3-1, closeOutboundInternal()
> nioEventLoopGroup-3-1, called closeInbound()
> nioEventLoopGroup-3-1, closeInboundInternal()
> 
> 
> 
> 
> ssl code:
>             SSLContext context = null;
>         try {
>             context = SSLContext.getInstance("TLS");
>             TrustManagerFactory tmf;
>             KeyStore ks = KeyStore.getInstance("JKS");
>             ks.load(new FileInputStream(System.getProperty("user.dir") + "/cer/cacerts.jks"), password);
>             tmf = TrustManagerFactory.getInstance("SunX509");
>             tmf.init(ks);
>             TrustManager[] tm = tmf.getTrustManagers();
>             context.init(null,tm, null);
>         } catch (CertificateException | NoSuchAlgorithmException | KeyStoreException | IOException | KeyManagementException e) {
>             e.printStackTrace();
>         }
> 
>                         SSLEngine sslEngine = sslContext.createSSLEngine();
> 			sslEngine.setUseClientMode(false);
> 			SslHandler sslHandler = new SslHandler(sslEngine);
> 			pipeline.addLast("ssl",sslHandler);
> 
> 
> 
> Why it doesn't work? Please help me,thanks!



On Monday, 27 July 2015 16:04:04 UTC+5:30, Louie  wrote:
> Hi
>  I'm using the netty with ssl, but it doesn't work.This is my error log and the ssl code.
> 
> error code:
>   adding as trusted cert:
>   Subject: EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>   Issuer:  EMAILADDRESS=xxx, CN=Louie, OU=SDG, O=SDG, L=SH, ST=SH, C=CN
>   Algorithm: RSA; Serial number: 0xffc3decf334dd844
>   Valid from Mon Jul 27 17:05:34 CST 2015 until Thu Jul 24 17:05:34 CST 2025
> 
> trigger seeding of SecureRandom
> done seeding SecureRandom
> NewsInterface server listening on port 443
> Using SSLEngineImpl.
> Using SSLEngineImpl.
> Ignoring unavailable cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
> Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA
> .
> .
> .
> Allow unsafe renegotiation: false
> Allow legacy hello messages: true
> Is initial handshake: true
> Is secure renegotiation: false
> .
> .
> Ignoring unavailable cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
> Ignoring unavailable cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
> 
> nioEventLoopGroup-3-2, READ: TLSv1 Handshake, length = 201
> *** ClientHello, TLSv1.2
> *** ClientHello, TLSv1.2
> RandomCookie:  RandomCookie:  GMT: 17143111 GMT: 76079028 bytes = { bytes = { 24147, , 165, 240, 26, 239, 99, 4, 230, 85, 246, 75, 36, 214, 149, 50, 109, 187, 118, 217, 152, 174, 60, 99, 181, 31, 202, 118, 201, 2, 178, 239, 249, 62, 162, 203, 203, 50, 131, 198, 170, 255, 215, 38, 231, 182, 4, 208, 243, 80, 235, 159117,  }
> 4, Session ID:  140, {}
> Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
> Compression Methods:  { 0 }
> Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
> Unsupported extension type_23, data: 
> Unsupported extension type_35, data: 
> Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
> Unsupported extension status_request, data: 01:00:00:00:00
> Unsupported extension type_13172, data: 
> Unsupported extension type_18, data: 
> Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
> Unsupported extension type_30032, data: 
> Extension ec_point_formats, formats: [uncompressed]
> Extension elliptic_curves, curve names: {secp256r1, secp384r1}
> ***
> 86 }
> Session ID:  {}
> Cipher Suites: [Unknown 0xcc:0x14, Unknown 0xcc:0x13, Unknown 0xcc:0x15, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
> Compression Methods:  { 0 }
> Extension server_name, server_name: [type=host_name (0), value=127.0.0.1]
> Unsupported extension type_23, data: 
> %% Initialized:  [Session-1, SSL_NULL_WITH_NULL_NULL]
> Unsupported extension type_35, data: 
> Extension signature_algorithms, signature_algorithms: SHA512withRSA, SHA512withECDSA, SHA384withRSA, SHA384withECDSA, SHA256withRSA, SHA256withECDSA, SHA224withRSA, SHA224withECDSA, SHA1withRSA, SHA1withECDSA
> Unsupported extension status_request, data: 01:00:00:00:00
> Unsupported extension type_13172, data: 
> Unsupported extension type_18, data: 
> Unsupported extension type_16, data: 00:1b:08:68:74:74:70:2f:31:2e:31:08:73:70:64:79:2f:33:2e:31:05:68:32:2d:31:34:02:68:32
> Unsupported extension type_30032, data: 
> Extension ec_point_formats, formats: [uncompressed]
> Extension elliptic_curves, curve names: {secp256r1, secp384r1}
> ***
> %% Initialized:  [Session-2, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-1, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated:  [Session-1, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-1, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
> nioEventLoopGroup-3-2, fatal error: 40: no cipher suites in common
> javax.net.ssl.SSLHandshakeException: no cipher suites in common
> %% Invalidated:  [Session-2, SSL_NULL_WITH_NULL_NULL]
> nioEventLoopGroup-3-2, SEND TLSv1.2 ALERT:  fatal, description = handshake_failure
> nioEventLoopGroup-3-2, WRITE: TLSv1.2 Alert, length = 2
> nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> nioEventLoopGroup-3-2, called closeOutbound()
> nioEventLoopGroup-3-2, closeOutboundInternal()
> nioEventLoopGroup-3-1, WRITE: TLSv1.2 Alert, length = 2
> nioEventLoopGroup-3-2, called closeInbound()
> nioEventLoopGroup-3-2, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
> nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: no cipher suites in common
> nioEventLoopGroup-3-1, called closeOutbound()
> nioEventLoopGroup-3-1, closeOutboundInternal()
> nioEventLoopGroup-3-1, called closeInbound()
> nioEventLoopGroup-3-1, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLException: Inbound closed before receiving peer's close_notify: possible truncation attack?
> Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.
> 
> Your session is protected by SSL_NULL_WITH_NULL_NULL cipher suite.
> 
> nioEventLoopGroup-3-2, called closeOutbound()
> nioEventLoopGroup-3-2, closeOutboundInternal()
> nioEventLoopGroup-3-2, called closeInbound()
> nioEventLoopGroup-3-2, closeInboundInternal()
> nioEventLoopGroup-3-1, called closeOutbound()
> nioEventLoopGroup-3-1, closeOutboundInternal()
> nioEventLoopGroup-3-1, called closeInbound()
> nioEventLoopGroup-3-1, closeInboundInternal()
> 
> 
> 
> 
> ssl code:
>             SSLContext context = null;
>         try {
>             context = SSLContext.getInstance("TLS");
>             TrustManagerFactory tmf;
>             KeyStore ks = KeyStore.getInstance("JKS");
>             ks.load(new FileInputStream(System.getProperty("user.dir") + "/cer/cacerts.jks"), password);
>             tmf = TrustManagerFactory.getInstance("SunX509");
>             tmf.init(ks);
>             TrustManager[] tm = tmf.getTrustManagers();
>             context.init(null,tm, null);
>         } catch (CertificateException | NoSuchAlgorithmException | KeyStoreException | IOException | KeyManagementException e) {
>             e.printStackTrace();
>         }
> 
>                         SSLEngine sslEngine = sslContext.createSSLEngine();
> 			sslEngine.setUseClientMode(false);
> 			SslHandler sslHandler = new SslHandler(sslEngine);
> 			pipeline.addLast("ssl",sslHandler);
> 
> 
> 
> Why it doesn't work? Please help me,thanks!

Hi Louie,

I am interested to know how you fixed the issue, because even  I am facing a similar one.

Thanks,
Phalgun

[toc] | [prev] | [standalone]

csiph-web

netty with ssl

Contents

#32157 — netty with ssl

#32158

#32160

#32161

#32162

#32163

#32178

#32181

#33913