directory-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Stefan Seelmann (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (DIRSTUDIO-1113) SSL Handshake failed Certificates does not conform to algorithm constraints using recent Java version >1.8.0_77
Date Tue, 30 Aug 2016 19:50:20 GMT

    [ https://issues.apache.org/jira/browse/DIRSTUDIO-1113?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15449954#comment-15449954
] 

Stefan Seelmann commented on DIRSTUDIO-1113:
--------------------------------------------

Which server do you try to connect to?

If you try to connect to the included ApacheDS LDAP server with its auto-generated key: That
is a 512 bit RSA key, and due to US export restrictions (at least as far as I understand)
we are not allowed to release sofware that generates a stronger key. So you need generate
and import a stronger key yourself. How it works is described at https://directory.apache.org/apacheds/basic-ug/3.3-enabling-ssl.html,
hopefully it is up-to-date.


> SSL Handshake failed Certificates does not conform to algorithm constraints using recent
Java version >1.8.0_77
> ---------------------------------------------------------------------------------------------------------------
>
>                 Key: DIRSTUDIO-1113
>                 URL: https://issues.apache.org/jira/browse/DIRSTUDIO-1113
>             Project: Directory Studio
>          Issue Type: Bug
>    Affects Versions: 2.0.0-M10 (2.0.0.v20151221-M10)
>         Environment: Windows 7 - JRE >1.8.0_77
>            Reporter: nkilani
>              Labels: security, ssl
>
> Unable to connect to LDAP server through SSL when JRE version is recent > 1.8.0_77
> error log:
> !ENTRY org.apache.directory.studio.slf4j-eclipselog 2 0 2016-08-30 18:20:44.475
> !MESSAGE SSL handshake failed.
> !STACK 0
> javax.net.ssl.SSLHandshakeException: SSL handshake failed.
> 	at org.apache.mina.filter.ssl.SslFilter.messageReceived(SslFilter.java:519)
> 	at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:542)
> 	at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1300(DefaultIoFilterChain.java:48)
> 	at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:943)
> 	at org.apache.mina.core.filterchain.IoFilterAdapter.messageReceived(IoFilterAdapter.java:109)
> 	at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:542)
> 	at org.apache.mina.core.filterchain.DefaultIoFilterChain.fireMessageReceived(DefaultIoFilterChain.java:535)
> 	at org.apache.mina.core.polling.AbstractPollingIoProcessor.read(AbstractPollingIoProcessor.java:697)
> 	at org.apache.mina.core.polling.AbstractPollingIoProcessor.process(AbstractPollingIoProcessor.java:651)
> 	at org.apache.mina.core.polling.AbstractPollingIoProcessor.process(AbstractPollingIoProcessor.java:640)
> 	at org.apache.mina.core.polling.AbstractPollingIoProcessor.access$600(AbstractPollingIoProcessor.java:68)
> 	at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:1097)
> 	at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64)
> 	at java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
> 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
> 	at java.lang.Thread.run(Unknown Source)
> Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
> 	at sun.security.ssl.Handshaker.checkThrown(Unknown Source)
> 	at sun.security.ssl.SSLEngineImpl.checkTaskThrown(Unknown Source)
> 	at sun.security.ssl.SSLEngineImpl.writeAppRecord(Unknown Source)
> 	at sun.security.ssl.SSLEngineImpl.wrap(Unknown Source)
> 	at javax.net.ssl.SSLEngine.wrap(Unknown Source)
> 	at org.apache.mina.filter.ssl.SslHandler.handshake(SslHandler.java:600)
> 	at org.apache.mina.filter.ssl.SslHandler.messageReceived(SslHandler.java:359)
> 	at org.apache.mina.filter.ssl.SslFilter.messageReceived(SslFilter.java:500)
> 	... 15 more
> Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
> 	at sun.security.ssl.Alerts.getSSLException(Unknown Source)
> 	at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source)
> 	at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
> 	at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
> 	at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
> 	at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
> 	at sun.security.ssl.Handshaker.processLoop(Unknown Source)
> 	at sun.security.ssl.Handshaker$1.run(Unknown Source)
> 	at sun.security.ssl.Handshaker$1.run(Unknown Source)
> 	at java.security.AccessController.doPrivileged(Native Method)
> 	at sun.security.ssl.Handshaker$DelegatedTask.run(Unknown Source)
> 	at org.apache.mina.filter.ssl.SslHandler.doTasks(SslHandler.java:791)
> 	at org.apache.mina.filter.ssl.SslHandler.handshake(SslHandler.java:566)
> 	... 17 more
> Caused by: java.security.cert.CertificateException: Certificates does not conform to
algorithm constraints
> 	at sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(Unknown Source)
> 	at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(Unknown Source)
> 	at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source)
> 	... 26 more



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message