Handshake process of SSL/TLS with javax.net.ssl.SSLHandshakeException:Received fatal Alert:handshake_failure exception

Reprinted from http://blog.csdn.net/taiyangdao/article/details/54707184

I. Handshake process of SSL/TLS

During the handshake process of SSL/TLS, parameters need to be exchanged between the client and the server, as follows:

1. The client provides various cipher suites that it supports (including cryptographic algorithms and hash functions)
2. The server chooses the cipher suite that it also supports and notifies the client that the two will transfer the data
3. The server also sends its own digital certificate (including the server name, CA, and public key) as an identifier to the client
4. Client confirms the validity of the server's digital certificate to the CA
5. Client-generated session key (subsequent data transfer between client and server will use this session key)

• • Use the server's public key encryption session key to send to the server
  • Or the client can also use the DH key exchange

Two. Handshake_failure Anomaly analysis

In the process of SSL/TLS communication between the client and the server, the following exceptions often occur:

Javax.net.ssl.SSLHandshakeException:Received Fatal Alert:handshake_failure  

First, the timing of this exception occurs when the effective data transfer between the client and the server has not started during the handshake between the client and the server.

Reason one: For the above handshake process, this exception often occurs in the 4th step, when the client obtains the server's digital certificate, when verifying the validity of the certificate to the CA.

When a client attempts to authenticate to a trusted CA, it discovers that the CA referenced by the server's digital certificate does not appear in the client's Trust store.

Reason two: Additionally, the exception may be due to inconsistencies between the client and the SSL/TLS version used by the server. The server uses a high TLS version, while the client supports a low TLS version.

At this point, you can set the JVM parameters for the client as follows to improve the TLS version of the client:

-dhttps.protocols=tlsv1.2,tlsv1.1,tlsv1.0,sslv3,sslv2hello  

Both of these reasons can be resolved by upgrading the JDK to 1.8. Java 8 supports the TLSv1.2 version by default. JDK 1.6 does not support TLSv1.2

Handshake process of SSL/TLS with javax.net.ssl.SSLHandshakeException:Received fatal Alert:handshake_failure exception