SSL LDAP 查找失败，handshake_failure

Posted 2023-02-22

【中文标题】SSL LDAP 查找失败，handshake_failure

【英文标题】：SSL LDAP lookup FAILS with handshake_failure

【发布时间】：2013-07-14 17:32:26

【问题描述】：

我正在尝试连接到启用了 SSL 的 LDAP 服务器。我不想使用身份验证，因此我重写了 SSLSocketFactory 以允许每个站点。我收到以下错误：

main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: **handshake_failure**
    javax.naming.CommunicationException: slc00ahj.us.oracle.com:3131 Root exception is javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

at com.sun.jndi.ldap.Connection.<init>(Connection.java:209)
at com.sun.jndi.ldap.LdapClient.<init>(LdapClient.java:116)
at com.sun.jndi.ldap.LdapClient.getInstance(LdapClient.java:1582)
at com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2678)
at com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:296)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:175)
at com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:193)
at com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:136)
at com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:66)
at javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:667)
at javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:288)
at javax.naming.InitialContext.init(InitialContext.java:223)
at javax.naming.InitialContext.<init>(InitialContext.java:197)
at javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:82)
at SumanLdapTest1.main(SumanLdapTest1.java:37)

SSL 日志为：

 Allow unsafe renegotiation: false
    Allow legacy hello messages: true
    Is initial handshake: true
    Is secure renegotiation: false
    main, setSoTimeout(120) called
    %% No cached client session
    ClientHello, TLSv1 
    RandomCookie: GMT: 1357201614 bytes =  70, 133, 164, 224, 89, 101, 204, 41, 107, 201, 176, 66, 93, 118, 139, 59, 50, 176, 84, 197, 238, 236, 187, 211, 158, 43, 159, 112 
    Session ID: 
    Cipher Suites: SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV
    Compression Methods:  0 
    ***
    **main, WRITE: TLSv1 Handshake, length = 75
    main, READ: TLSv1 Alert, length = 2
    main, RECV TLSv1 ALERT: fatal, handshake_failure
    main, called closeSocket()**




**My source code:**





    public class **SumanLdapTest1**
        public static void main(String args[])
       try
                //System.setProperty("ldaps.protocols", "TLSv1");
                 System.out.println("here");
                 DirContext ctx = null;
            String host="slc00ahj.us.oracle.com"; 
            String port="3131";
            String userName="cn=orcladmin";
            String password="welcome1";
            Hashtable<String, String> env = new Hashtable<String, String>();
            env.put(Context.INITIAL_CONTEXT_FACTORY,
                            "com.sun.jndi.ldap.LdapCtxFactory");
            //env.put(Context.PROVIDER_URL, "ldap://" + host + ":"+ port+ "/");
            env.put(Context.SECURITY_PRINCIPAL, userName);
            env.put(Context.SECURITY_CREDENTIALS, password);
            env.put(Context.SECURITY_AUTHENTICATION, "simple");
            env.put("com.sun.jndi.ldap.connect.timeout", "120");
            env.put(Context.PROVIDER_URL, "ldaps://" + host
                            + ":" + port);
            env.put(Context.SECURITY_PROTOCOL, "ssl");
            env.put("java.naming.ldap.factory.socket","**SumanSSLFactory**");
            ctx = new InitialDirContext(env);
            catch(Exception e)
                e.printStackTrace();
            
        
    

    public class SumanSSLFactory extends SSLSocketFactory 
            private SSLSocketFactory factory = null;
        private Exception exception = null;

        public SumanSSLFactory() 
            System.out.println("LdapSSLFactory initialization started...");


            try 
                this.factory = **getSSLSocketFactory**();
             catch (Exception ex) 
                            ex.printStackTrace();
                System.out.println("LDAPSSLFactory Initialization error");
                this.factory = null;
                this.exception = ex;
            

            System.out.println("LdapSSLFactory Initialization completed.");
        

        public SSLSocket createSocket() throws IOException 
            System.out.println("LdapSSLFactory.createSocket()");
            if (this.factory == null)
                throw new IOException();
            SSLSocket st=null;
            try


                    (new Throwable()).printStackTrace();
                     st=(SSLSocket)this.factory.createSocket();
                    st.setEnabledProtocols( new String[]  "TLSv1", "SSLv3"  );  

                         catch(Exception e)
                             e.printStackTrace();
                         

            return st;
        


        private SSLSocketFactory **getSSLSocketFactory**()
                        
                SSLSocketFactory sslSocketFactory = null;
                System.out.println("Using Non Authenticated SSL Mechanism.");
                try 
                        TrustManager[] tmA =  new X509TrustManager() 
                                public X509Certificate[] getAcceptedIssuers() 
                                        X509Certificate[] issuers = new X509Certificate[0];
                                        return issuers;
                                    //return null;
                                

                                public void checkClientTrusted(X509Certificate[] chain,
                                                String authType) throws CertificateException 
                                

                                public void checkServerTrusted(X509Certificate[] chain,
                                                String authType) throws CertificateException 
                                
                         ;

                        // get the SSLContext and factory
                        SSLContext ctx = SSLContext.getInstance("TLS");
                        ctx.init(null, tmA, null);
                        sslSocketFactory = ctx.getSocketFactory();
                   // System.setProperty("ldaps.protocols", "TLSv1");
                    System.out.println("SSOSocketUtil factory created sslSocketFactory"+sslSocketFactory);
                 catch (Exception ex) 
                    ex.printStackTrace();
                    System.out.println("SSOSocketUtil factory exception");

                

                return sslSocketFactory;
        

    

Any help on this will be appreciated    

【参考方案1】：

我会在不使用您的代码的情况下进行测试。例如，尝试使用 LDAP Utils 二进制文件之一（例如：ldapsearch、ldapwhoami 等）测试某种 SSL 操作。确保 SSL/TLS 以这种方式工作。

如果不起作用，请检查您的本地系统 LDAP 设置，并验证服务器使用的证书未过期且未自签名（允许使用自签名证书，但需要进一步配置）。

此外，请确保服务器正在通过 LDAPS 而不是 LDAP 侦听您的特殊端口（3131？）。如果侦听器使用常规 LDAP，则不支持 SSL，但支持 TLS (StartTLS)。请注意，LDAP SSL 在技术上已被弃用，取而代之的是 TLS。如果您能够使用 TLS 而不是 SSL，那么您应该这样做。

最后在服务器端，确保 RootDSE 显示 TLS/SSL 支持的 OID (1.3.6.1.4.1.1466.20037)。如果您没有看到这一点，则服务器不支持 SSL/TLS（至少对于 OpenLDAP 是这样）。

如果命令行二进制测试有效，那么我将不得不假设它是代码本身或运行代码的主机上的系统 LDAP 设置。或两者。

我（一点也不）精通 JAVA，但无论如何我查看了您的代码并没有发现任何明显错误。如果代码本身有直接问题，那我问错人了=)

如果您无法修复您的代码，请尽可能尝试将您的代码更改为不使用 SSL/TLS。至少您可以确定代码的预期功能有效，而不是安全传输。这至少大大缩小了范围。当然，如果此类测试存在安全问题，您可能需要做出特殊安排（例如：使用 stunnel，或者在 LDAP 服务器上本地运行脚本等）。

我希望这会有所帮助...

最大