使用SSL的Android和Python之间的协议错误

Question

这个问题已经被问了好几次，各种各样。不幸的是，没有一个答案能为我找到解决办法。在

我尝试使用https协议连接到pythonweb服务器（代码如下），包括客户端身份验证。当我通过为测试而编写的python客户机连接时，我没有问题。快进一步，我正在尝试从Android设备连接（代码再次跟随），并得到一个

javax.net.ssl.SSLProtocolException

我有一个自签名的CA，它颁发了两个证书。一个用于客户端，一个用于服务器。在

我使用以下方法从服务器私钥中删除了密码短语：

openssl rsa -in serverKey.pem -out serverKey.pem

并从linux命令行使用openssl发出请求。在

对于客户机，我发出了一个请求，创建了证书，然后使用keytool和BouncyCastle提供程序将CA导入信任存储区，并将客户机证书导入密钥存储区（我意识到它们是相同的格式，如果我用不同的名称引用它们，则有助于保持它们之间的分隔）。在

相关服务器代码：

^{pr2}$

Android客户端代码：

//add bouncy castle to the list of security providers
Security.insertProviderAt(new BouncyCastleProvider(), 1);

//load the trusted CA
KeyStore trusted = KeyStore.getInstance("BKS");
InputStream in = getResources().openRawResource(R.raw.mobilecastore);
trusted.load(in, "password".toCharArray());
in.close();
TrustManagerFactory trust_factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
trust_factory.init(trusted);

//load the client keystore
KeyStore client = KeyStore.getInstance(KeyStore.getDefaultType());
InputStream client_in = getResources().openRawResource(R.raw.client);
client.load(client_in, "password2".toCharArray());
client_in.close();
KeyManagerFactory key_factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());

key_factory.init(client, "password2".toCharArray());

SSLContext ssl_context = SSLContext.getInstance("SSL"); 
ssl_context.init(key_factory.getKeyManagers(), trust_factory.getTrustManagers(), null);

URL url = new URL("https", IP, 60000, "/cgi-bin/www_sel_jf");
connection = (HttpsURLConnection) url.openConnection();
connection.setSSLSocketFactory(ssl_context.getSocketFactory());
connection.setDoInput(true);
connection.setRequestMethod("GET");
connection.connect();

错误：

12-31 07:23:37.917: W/System.err(3666): javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x16bab18: Failure in SSL library, usually a protocol error
12-31 07:23:37.917: W/System.err(3666): error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (external/openssl/ssl/s3_pkt.c:1234 0x16bf980:0x00000003)
12-31 07:23:37.917: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:460)
12-31 07:23:37.917: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:257)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpConnection.setupSecureSocket(HttpConnection.java:210)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.makeSslConnection(HttpsURLConnectionImpl.java:477)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:441)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpEngine.sendSocketRequest(HttpEngine.java:282)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpEngine.sendRequest(HttpEngine.java:232)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:80)
12-31 07:23:37.917: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:164)
12-31 07:23:37.917: W/System.err(3666):     at com.dsndata.sds2mobile.status.activities.ServerJobs$RetrieveJobNames.doInBackground(ServerJobs.java:143)
12-31 07:23:37.917: W/System.err(3666):     at com.dsndata.sds2mobile.status.activities.ServerJobs$RetrieveJobNames.doInBackground(ServerJobs.java:1)
12-31 07:23:37.917: W/System.err(3666):     at android.os.AsyncTask$2.call(AsyncTask.java:264)
12-31 07:23:37.925: W/System.err(3666):     at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
12-31 07:23:37.925: W/System.err(3666):     at java.util.concurrent.FutureTask.run(FutureTask.java:137)
12-31 07:23:37.925: W/System.err(3666):     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
12-31 07:23:37.925: W/System.err(3666):     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
12-31 07:23:37.925: W/System.err(3666):     at java.lang.Thread.run(Thread.java:856)
12-31 07:23:37.925: W/System.err(3666): Caused by: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x16bab18: Failure in SSL library, usually a protocol error
12-31 07:23:37.925: W/System.err(3666): error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (external/openssl/ssl/s3_pkt.c:1234 0x16bf980:0x00000003)
12-31 07:23:37.925: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.NativeCrypto.SSL_do_handshake(Native Method)
12-31 07:23:37.925: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:410)
12-31 07:23:37.925: W/System.err(3666):     ... 16 more
12-31 07:23:37.925: W/System.err(3666): javax.net.ssl.SSLHandshakeException: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x16bab18: Failure in SSL library, usually a protocol error
12-31 07:23:37.925: W/System.err(3666): error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (external/openssl/ssl/s3_pkt.c:1234 0x16bf980:0x00000003)
12-31 07:23:37.925: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:460)
12-31 07:23:37.925: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:257)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpConnection.setupSecureSocket(HttpConnection.java:210)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.makeSslConnection(HttpsURLConnectionImpl.java:477)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl$HttpsEngine.connect(HttpsURLConnectionImpl.java:441)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpEngine.sendSocketRequest(HttpEngine.java:282)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpEngine.sendRequest(HttpEngine.java:232)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:80)
12-31 07:23:37.925: W/System.err(3666):     at libcore.net.http.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:164)
12-31 07:23:37.925: W/System.err(3666):     at com.dsndata.sds2mobile.status.activities.ServerJobs$RetrieveJobNames.doInBackground(ServerJobs.java:143)
12-31 07:23:37.932: W/System.err(3666):     at com.dsndata.sds2mobile.status.activities.ServerJobs$RetrieveJobNames.doInBackground(ServerJobs.java:1)
12-31 07:23:37.932: W/System.err(3666):     at android.os.AsyncTask$2.call(AsyncTask.java:264)
12-31 07:23:37.932: W/System.err(3666):     at java.util.concurrent.FutureTask$Sync.innerRun(FutureTask.java:305)
12-31 07:23:37.932: W/System.err(3666):     at java.util.concurrent.FutureTask.run(FutureTask.java:137)
12-31 07:23:37.932: W/System.err(3666):     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1076)
12-31 07:23:37.932: W/System.err(3666):     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:569)
12-31 07:23:37.932: W/System.err(3666):     at java.lang.Thread.run(Thread.java:856)
12-31 07:23:37.932: W/System.err(3666): Caused by: javax.net.ssl.SSLProtocolException: SSL handshake terminated: ssl=0x16bab18: Failure in SSL library, usually a protocol error
12-31 07:23:37.932: W/System.err(3666): error:14094410:SSL routines:SSL3_READ_BYTES:sslv3 alert handshake failure (external/openssl/ssl/s3_pkt.c:1234 0x16bf980:0x00000003)
12-31 07:23:37.932: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.NativeCrypto.SSL_do_handshake(Native Method)
12-31 07:23:37.932: W/System.err(3666):     at org.apache.harmony.xnet.provider.jsse.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:410)
12-31 07:23:37.932: W/System.err(3666):     ... 16 more

需要注意的是，我正在使用javax.net.ssl而不是apache。在

编辑： python服务器托管在Windows计算机上。对于Windows端口上的ssl，是否需要考虑任何额外的配置？在

编辑：是的，需要做一些事情来允许windows端口上的SSL。已切换到端口443（指定用于SSL通信）和am正在进行（缓慢）进程。在

编辑： 我现在可以使用Wireshark跟踪请求了（对于这个问题，我学到了很多东西！）Wireshark告诉我有个405错误。这在SSL中意味着无法识别证书格式。python服务器正在使用PEM证书（python文档允许的唯一格式），并且导入到Android设备上keystore中的证书是DER（据我所知，BKS唯一接受的格式）。在

任何帮助都将不胜感激。在

Answer 1

在学习了如何读取数据包后，发现问题出在我的证书上。公用名与URL不匹配。在

Answer 2

这可能是SSL/TLS版本或算法不匹配错误。您的服务器使用sslv.2-3，而这是相当旧的，应该使用tls1.0-1.2。 最好的调试方法是运行Wireshark，并查看发送哪个客户端和服务器的SSL/TLS握手包以及何时断开连接。在