Quantcast
Channel: Active questions tagged https - Stack Overflow
Viewing all articles
Browse latest Browse all 1548

Failure to connect to Spring project running on server with HTTPS (SSL error)

$
0
0

I've setup a Spring Framework 5 project working very well so far. Needed to enable HTTPS for some functionality so followed a tutorial. Currently generated the certificate and key on the server with the following command:

keytool -genkeypair -alias tomcat -storetype PKCS12 -keyalg RSA -keysize 2048 -keystore keystore.p12 -validity 365000

I've then imported this keystore into my resources folder and used the following properties:

server.ssl.key-store= classpath:keystore.p12server.ssl.key-store-password= myPasswordserver.ssl.key-store-type= PKCS12server.ssl.key-alias= tomcatserver.port= 8444

I've also setup a redirect from HTTP to HTTPS with the following configuration:

@Beanpublic ServletWebServerFactory servletContainer() {    TomcatServletWebServerFactory tomcat = new TomcatServletWebServerFactory() {        @Override        protected void postProcessContext(Context context) {            SecurityConstraint securityConstraint = new SecurityConstraint();            securityConstraint.setUserConstraint("CONFIDENTIAL");            SecurityCollection collection = new SecurityCollection();            collection.addPattern("/*");            securityConstraint.addCollection(collection);            context.addConstraint(securityConstraint);        }    };    tomcat.addAdditionalTomcatConnectors(redirectConnector());    return tomcat;}private Connector redirectConnector() {    Connector connector = new Connector("org.apache.coyote.http11.Http11NioProtocol");    connector.setScheme("http");    connector.setPort(8182);    connector.setSecure(false);    connector.setRedirectPort(8444);    return connector;}

When running locally from my IDE or by running the compiled .jar it works fine. However when I try to run it on my server (a locally running Synology NAS that previously worked fine) I get errors when trying to reach the address (https://192.168.10.10:8444) with the following error on Firefox: SSL_ERROR_NO_CYPHER_OVERLAPand on chrome ERR_SSL_VERSION_OR_CIPHER_MISMATCH. I've looked for answers but I have not found any solutions that changed the outcome of this problem.

Available JDK CIPHERs on the server:

Default Cipher        SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA*       SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA        SSL_DHE_DSS_WITH_DES_CBC_SHA        SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA*       SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA        SSL_DHE_RSA_WITH_DES_CBC_SHA        SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA        SSL_DH_anon_WITH_3DES_EDE_CBC_SHA        SSL_DH_anon_WITH_DES_CBC_SHA        SSL_RSA_EXPORT_WITH_DES40_CBC_SHA*       SSL_RSA_WITH_3DES_EDE_CBC_SHA        SSL_RSA_WITH_DES_CBC_SHA        SSL_RSA_WITH_NULL_MD5        SSL_RSA_WITH_NULL_SHA*       TLS_DHE_DSS_WITH_AES_128_CBC_SHA*       TLS_DHE_DSS_WITH_AES_128_CBC_SHA256*       TLS_DHE_DSS_WITH_AES_128_GCM_SHA256*       TLS_DHE_DSS_WITH_AES_256_CBC_SHA*       TLS_DHE_DSS_WITH_AES_256_CBC_SHA256*       TLS_DHE_DSS_WITH_AES_256_GCM_SHA384*       TLS_DHE_RSA_WITH_AES_128_CBC_SHA*       TLS_DHE_RSA_WITH_AES_128_CBC_SHA256*       TLS_DHE_RSA_WITH_AES_128_GCM_SHA256*       TLS_DHE_RSA_WITH_AES_256_CBC_SHA*       TLS_DHE_RSA_WITH_AES_256_CBC_SHA256*       TLS_DHE_RSA_WITH_AES_256_GCM_SHA384        TLS_DH_anon_WITH_AES_128_CBC_SHA        TLS_DH_anon_WITH_AES_128_CBC_SHA256        TLS_DH_anon_WITH_AES_128_GCM_SHA256        TLS_DH_anon_WITH_AES_256_CBC_SHA        TLS_DH_anon_WITH_AES_256_CBC_SHA256        TLS_DH_anon_WITH_AES_256_GCM_SHA384*       TLS_EMPTY_RENEGOTIATION_INFO_SCSV        TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5        TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA        TLS_KRB5_WITH_3DES_EDE_CBC_MD5        TLS_KRB5_WITH_3DES_EDE_CBC_SHA        TLS_KRB5_WITH_DES_CBC_MD5        TLS_KRB5_WITH_DES_CBC_SHA*       TLS_RSA_WITH_AES_128_CBC_SHA*       TLS_RSA_WITH_AES_128_CBC_SHA256*       TLS_RSA_WITH_AES_128_GCM_SHA256*       TLS_RSA_WITH_AES_256_CBC_SHA*       TLS_RSA_WITH_AES_256_CBC_SHA256*       TLS_RSA_WITH_AES_256_GCM_SHA384        TLS_RSA_WITH_NULL_SHA256

My openSSL s_client connect output:

No client certificate CA names sentPeer signing digest: SHA256Peer signature type: RSAServer Temp Key: DH, 1024 bits---SSL handshake has read 1601 bytes and written 505 bytesVerification error: self signed certificate---New, TLSv1.2, Cipher is DHE-RSA-AES256-GCM-SHA384Server public key is 2048 bitSecure Renegotiation IS supportedCompression: NONEExpansion: NONENo ALPN negotiatedSSL-Session:    Protocol  : TLSv1.2    Cipher    : DHE-RSA-AES256-GCM-SHA384    Session-ID: 5B9B776C430F2AEF917BAE78C14F78CDC6DB2F0ED7284E66EFAF9688319F46B2    Session-ID-ctx:    Master-Key: FBA675AEDE7EB03926991415E6760249DE82E4967EC7A724D04C1D8FEFC2C3CC37DFC84ACD29607CAF88775EBBD6E519    PSK identity: None    PSK identity hint: None    SRP username: None    Start Time: 1536915308    Timeout   : 7200 (sec)    Verify return code: 18 (self signed certificate)    Extended master secret: no---

Viewing all articles
Browse latest Browse all 1548

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>