使用Apache Httpclient和WebSphere Liberty Profile设置TLS版本

Question

我们正在从使用Apache HTTPClient 4.3.5连接到服务的WebSphere Liberty Profile（8.5.5.6）REST服务访问外部服务。

该服务刚更改为使用TLS v1.2，现在我们的服务失败： [4/21/16 12：23：37：596 EDT] 0000005d bm.myw3.services.awf.sso。 ejb.generator.SSOTokenGeneratorImpl I Exception :: javax.net.ssl.SSLException：收到致命警报：protocol_version [4/21/16 12：23：37：597 EDT] 0000005d com.ibm.myw3.services.awf.sso .ejb.SSOTokenManagerBeanèSSOTokenGeneratorException :: {0} com.ibm.myw3.services.awf.sso.ejb.config.SSOTokenGeneratorException：异常而执行检索令牌HTTP请求

我们发现下面的链接，并实现它在我们的代码：
How to set TLS version on apache HttpClient

SSLContext sslContext = SSLContexts.custom().useTLS().build(); 
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new String[] { "TLSv1.2" }, null, SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 

我还设置 'https.protocols'：

wasadmin 28548 1 10 12:28 PTS/0○时00分55秒/usr/lib/jvm/jre-1.7.1- ibm.x86_64/bin/java -javaagent：/opt/IBM/WebSphere/Liberty/wlp/bin/tools/ws-javaagent.jar -Djava.awt.headless = true -XX：MaxPermSize = 256m -Dcom.ibm.security .jurisdictionsPolicyDir =/devops/w3Services/ssoProxy -Dhttps.protocols = TLSv1.2，TLSv1.1，TLSv1 -jar /opt/IBM/WebSphere/Liberty/wlp/bin/tools/ws-server.jar w3svcs-ssoproxy-svr1

但它没有区别。我们需要做些什么才能使其与WLP一起工作？

Answer 1

我们已经尝试了一些其他的东西，这里是我们最新的代码迭代：

SSLContext sslContext = SSLContexts.custom().useProtocol("TLSv1.2").build(); 
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new String[] { "TLSv1.2" }, 
    new String[] { "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" }, 
    SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 
HttpClientBuilder httpClientBuilder = HttpClientBuilder.create().setDefaultRequestConfig(requestConfig) 
    .setConnectionManager(connManager).setSSLSocketFactory(sslsf); 
handleAuthentication(uri, httpClientBuilder); 
httpClient = httpClientBuilder.build(); 

我也设置以下JVM选项：
JVM_ARGS = -Dhttps.protocols = TLSv1.2工作-Djdk.tls.client.protocols = TLSv1.2工作-Djavax.net.debug =所有

但我们仍然得到错误：

[16年4月21日17：27：37：123 EDT ] 00000042 id = bm.myw3.services.awf.sso.ejb.generator.SSOTokenGeneratorImpl IE xception :: javax.net.ssl.SSLException：收到致命警报：protocol_version
[4/21/16 17：27：37：124 EDT] 00000042 id = com.ibm.myw3.services.awf.sso.ejb。 SSOTokenManagerBeanËSSOTokenGeneratorException :: {0} com.ibm.myw3.services.awf.sso.ejb.config.SSOTokenGeneratorException：异常而执行用于检索令牌

http请求我有从WLP，一个trace.log中我可以上传，如果有人认为这将是有益的看到。但这里AER各个条目从跟踪：

Default Executor-thread-25, WRITE: TLSv1.2 Handshake, length = 80 
Default Executor-thread-25, WRITE: TLSv1.2 Application Data, length = 256 
Default Executor-thread-25, READ: TLSv1.2 Application Data, length = 1552 
SEND TLSv1.2 ALERT: 
Finalizer thread, WRITE: TLSv1.2 Alert, length = 64 

然后它继续尝试使用TLSv1，这是我们正在调用该服务不支持了。我不确定为了确定为什么不使用TLSv1.2需要查找什么，但是没有任何东西从跟踪中跳出来。

Answer 2

构建HttpClient实例时，无法同时设置自定义套接字工厂和完全初始化的连接管理器。方法#setConnectionManager取代#setSSLSocketFactory。

执行下列任本

SSLContext sslContext = SSLContexts.custom().useProtocol("TLSv1.2").build(); 
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new String[] { "TLSv1.2" }, 
     new String[] { "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" }, 
     SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 
HttpClientBuilder httpClientBuilder = HttpClientBuilder.create() 
     .setDefaultRequestConfig(requestConfig) 
     .setSSLSocketFactory(sslsf); 

或本

SSLContext sslContext = SSLContexts.custom().useProtocol("TLSv1.2").build(); 
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, new String[] { "TLSv1.2" }, 
     new String[] { "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256" }, 
     SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER); 

Registry<ConnectionSocketFactory> socketFactoryRegistry = RegistryBuilder.<ConnectionSocketFactory>create() 
     .register("http", PlainConnectionSocketFactory.getSocketFactory()) 
     .register("https", sslsf) 
     .build(); 
PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(socketFactoryRegistry); 

HttpClientBuilder httpClientBuilder = HttpClientBuilder.create() 
     .setDefaultRequestConfig(requestConfig) 
     .setConnectionManager(cm); 

哦，是的，还有一两件事。请考虑升级到4.5