Java RMI over SSL connection terminating with "no cipher suites in common" message

The problem is constant, whether the JavaWrapper is in user or not.
The Java Version the client is running on is 1.6.0_03.

can you post the code that starts server, and makes connection

The following code is the Request Server that sets up the RMI service over an SSL socket connection.  The Second part are the functions that set up and make the call to the rmi service from within our servlet running on JRun4.


package fsb.lib.process;

import javax.rmi.ssl.*;

import java.security.*;

import java.util.*;
import java.rmi.registry.*;
import java.rmi.server.*;
import java.rmi.*;
import java.io.IOException;
import java.io.File;

import org.apache.log4j.PropertyConfigurator;
import org.apache.log4j.Logger;

import fsb.lib.*;

public class RequestServer extends Object implements FsbConstants {

      private static final String[] SSL_PROTOCOLS = {"SSLv3"};
      private static final String[] SSL_SUITES = {"SSL_RSA_WITH_NULL_SHA"};

      private static final String DFLT_LOGJ = <filtered>;
      private static final String DFLT_C3P0 = <filtered>;
      private static final String DFLT_INIF =<filtered>;

      private static final String FLAG_HOST = <filtered>;
      private static final String FLAG_RECV = <filtered>;
      private static final String FLAG_SEND = <filtered>;
      private static final String FLAG_NAME = <filtered>;
      private static final String FLAG_INIF = <filtered>;
      private static final String FLAG_C3P0 = <filtered>;
      private static final String FLAG_LOGJ = <filtered>;
      private static final String FLAG_TIME = <filtered>;

      private static final String DFLT_NAME = <filtered>;
      private static final String DFLT_HOST = <filtered>;

      private static final int    DFLT_RECV = <filtered>;
      private static final int    DFLT_SEND = <filtered>;

      private static final int    NO_INDEX  = <filtered>;
      private static final int    LOG_TIMES = <filtered>;
      private static final int    OTHR_SIZE = <filtered>;

/*************************************************************************************/

      private static Logger logger;

      private SslRMIServerSocketFactory      ssf = null;
      private SslRMIClientSocketFactory      csf = null;

/*************************************************************************************/

/**
 * Checks to see if the index is within the proper range for the
 * command line argument
 *
 * @param  ndx   the index to be checked
 * @param  args  the command line arguments
 *
 * @return true if the index is withing the range, false otherwise
 */
      protected static boolean inRange(int ndx, String[] args) {
            //an argument index is in the valid range if its greater then 0 and less then the length of the argument list
            return ((FIRST < ndx) && (ndx < args.length));
            }

/**
 * Locates and returns a the index of the item following the flag value
 *
 * @param  flag  the value to be located in the array of String
 * @param  args  the command line arguments
 *
 * @return the index of the value following the flag
 */
      protected static int getIndex(String flag, String[] args) {
            //locate the flag in the arry, return the index of the next element in the array
            for(int x=FIRST; x<args.length; x++) if (args[x].equals(flag)) return (x + NEXT_INDEX);
            //if the flag is not found return a nonexistant index
            return NO_INDEX;
            }

/**
 * Locate and return the RMI Registry Port in the command line
 * argumnts, if it is not there return the default RMI Registry
 * Port
 *
 * @param  arguments  the command line arguments
 *
 * @return the port for the RMI Registry to listen on
 */
      protected static String getHostName(String[] arguments) {
            int index = getIndex(FLAG_HOST, arguments);
            if (inRange(index, arguments)) return arguments[index];
            return DFLT_HOST;
            }

/**
 * Locate and return the RMI Registry Port in the command line
 * argumnts, if it is not there return the default RMI Registry
 * Port
 *
 * @param  arguments  the command line arguments
 *
 * @return the port for the RMI Registry to listen on
 */
      protected static int getReceivePort(String[] arguments) {
            int index = getIndex(FLAG_RECV, arguments);
            if (inRange(index, arguments)) return Lib.getIntFor(arguments[index], NO_INDEX);
            return DFLT_RECV;
            }

/**
 * Locate and return the Request Handler Port in the command line
 * argumnts, if it is not there return the default Request Handler
 * Port
 *
 * @param  arguments  the command line arguments
 *
 * @return the port for the Request Handler to listen on
 */
      protected static int getSendPort(String[] arguments) {
            int index = getIndex(FLAG_SEND, arguments);
            if (inRange(index, arguments)) return Lib.getIntFor(arguments[index], NO_INDEX);
            return DFLT_SEND;
            }

/**
 * Locate and return type of service that is to be run on the RMI Registry
 *
 * @param  arguments  the command line arguments
 *
 * @return the type string for the rmi service
 */
      protected static String getServiceName(String[] arguments) {
            int index = getIndex(FLAG_NAME, arguments);
            if (inRange(index, arguments)) return arguments[index];
            return DFLT_NAME;
            }

/**
 * Locate and return the INI file in the command line argumnts, if
 * it is not there return the default INI file
 *
 * @param  arguments  the command line arguments
 *
 * @return the absolute path for the INI File
 */
      protected static String getIniFilePath(String[] arguments) {
            int index = getIndex(FLAG_INIF, arguments);
            if (inRange(index, arguments)) return arguments[index];
            return DFLT_INIF;
            }

/**
 * Locate and return the Log4J properties file in the command line
 * argumnts, if it is not there return the default file
 *
 * @param  arguments  the command line arguments
 *
 * @return the absolute path for the Log File
 */
      protected static String getLogFile(String[] arguments) {
            int index = getIndex(FLAG_LOGJ, arguments);
            if (inRange(index, arguments)) return arguments[index];
            return DFLT_LOGJ;
            }

/**
 * Locate and return the C3P0 properties file from the command
 * line argumnts, if it is not there return the default file
 *
 * @param  arguments  the command line arguments
 *
 * @return the absolute path for the C3P0 File
 */
      protected static String getC3P0File(String[] arguments) {
            int index = getIndex(FLAG_C3P0, arguments);
            if (inRange(index, arguments)) return arguments[index];
            return DFLT_C3P0;
            }

/**
 * prepare the current System object to create an SSL Connection
 */
      protected static void initSSLConnection(String keyStore, String keyPassword) {
            //Assert what needs to be bebuggedd
            System.setProperty("javax.net.debug","ssl,handshake,record");
            //Assert the location of the Keystore for the SSL Connections
            System.setProperty(KEY_STORE, keyStore);
            //Assert the Password for the SSL keystore
            System.setProperty(KEY_PSWRD, keyPassword);
            }

/**
 * Create and Return an SSL RMI Client Socket Factory
 *
 * @return a fully instantiated SSL RMI Client Socket
 */
      protected RMIClientSocketFactory getClientSocket() {
            if (csf == null) csf = new SslRMIClientSocketFactory();
            return csf;
            }

/**
 * Create and Return an SSL RMI Server Socket Factory
 *
 * @return a fully instantiated SSL RMI Server Socket
 */
      protected RMIServerSocketFactory getServerSocket() {
            if (ssf == null) ssf = new SslRMIServerSocketFactory(SSL_SUITES, SSL_PROTOCOLS, false);
            return ssf;
            }

/**
 * Create and Return a Request Handler
 *
 * @return  a Request Handler
 */
      protected Request getRequestHandler() throws RemoteException {
            //Create the Request Handler that will be handling the RMI Service Calls
            return (Request)new RequestHandler();
            }

/**
 * Return a link to the RMI Registry that is running on the supplied host and listening on the supplied port
 *
 * @param  host  the host the RMI service is running on
 * @param  recv  the socket the RMI Service is listening on
 *
 * @return  an RMI Stub as a Request Object
 */
      protected Registry getRMIRegistry() throws RemoteException { return getRMIRegistry(DFLT_RECV); }
      protected Registry getRMIRegistry(int recv) throws RemoteException {
            //Start the RMI Registry running and return a link to it
            return LocateRegistry.createRegistry(recv, getClientSocket(), getServerSocket());
            }

/**
 * Create and Return an RMI Stub Object Using a Secure Socket Language Connection
 *
 * @param  send  the socket part the RMI Communication will pass through
 *
 * @return  an RMI Stub as a Request Object
 */
      protected Request getRequestStub() throws RemoteException { return getRequestStub(DFLT_SEND); }
      protected Request getRequestStub(int send) throws RemoteException {
            //Export the Service
            return (Request) UnicastRemoteObject.exportObject(getRequestHandler(), send, getClientSocket(), getServerSocket());
            }

/**
 * Bind the Request Handler to the local registry
 *
 * @param  host  the system that the registy is to be located on
 * @param  recv  the socket the registry will be listening on
 * @param  send  the socket the registry will be forwarding too
 * @param  srvc  the name of the service the registry will bind to
 *
 * @return  True if the registry can be successfully bound to
 *
 * @throws  RemoteException if cannot get a handle to nor create a registry object
 * @throws  AccessException the registry is local and deies the system access to it
 * @throws  AlreadyBoundException if srvc is already bound
 *
 */
      protected boolean bindToRegistry(int recv, int send, String srvc) throws RemoteException, AccessException, AlreadyBoundException {
            Registry      registry = null;
            Request            request = null;

            try {
                  //get a stub link to the request processor
                  request = getRequestStub(send);
                  //get a handle to any existing registry
                  registry = LocateRegistry.getRegistry(recv);
                  //rebind to the request service to the registry
                  registry.rebind(srvc, request);
                  }
            //if the locate failed then there is no registry to bind to
            catch(RemoteException re) {
                  //if there is no request handler throw the exception
                  if (request == null) throw re;
                  //otherwise no registry exist so have the system create & return one
                  registry = getRMIRegistry(recv);
                  //bind the request service to the new registry
                  registry.bind(srvc, request);
                  }
            return true;
            }

/**
 * Report the successful start of the RMI Service
 *
 * @param  mesage  the message that the serviced succeeded in starting
 */
      protected void reportSuccess(String message) {
            //inform the system of a successful start
            System.out.println(message);
            //Log the successful starting of the service
            logger.info(message);
            }

/**
 * Report the unsuccessful start of the RMI Service in the logs
 *
 * @param  message  The error message for the failed survice
 */
      protected void reportFailure(String message) { logger.error(message); }
/**
 * Report the unsuccessful start of the RMI Service in the logs
 *
 * @param  message  The error message for the failed survice
 * @param  excp     the exception thrown that caused the service failure
 */
      protected void reportFailure(String message, Exception excp) {
            //Build the complete error message
            String report = message.concat(" due too ").concat(excp.getLocalizedMessage());
            //inform the system of the failed start
            System.err.println(report);
            //Log the message of the failed start
            logger.error(report);
            //also print the execution stack trace
            excp.printStackTrace();
            }

/*************************************************************************************/

/**
 * Constructor for a Request Server object.  This object sets up the
 * links between the RMI Registry listening on the rcv port and the
 * RequestHandler listening on the snd port
 *
 * @param  host  The address of the hosting system
 * @param  recv  The port the RMI Registry is listening on
 * @param  send  The port the Request Service will be listening on
 * @param  service  The name the service will be bound too
 *
 */
      public RequestServer(String host, int recv, int send, String service) {
            //build the base line message for the server that is to be set up
            String message = service.concat(" on ").concat(host).concat(" to ").concat(Integer.toString(recv));

            //Start the log4J service with the Request server
            logger = Logger.getLogger(INIData.get(LOGGER));
            try {
                  //try to bind the service to the registry and report the results
                  if (bindToRegistry(recv, send, service)) reportSuccess("Bound ".concat(message));
                  else reportFailure("Could not bind ".concat(message));
                  }
            catch (Exception excp) {
                  //Report the exception that caused the failure
                  excp.printStackTrace();
                  //report that the service failed to start
                  reportFailure("Could not bind ".concat(message), excp);
                  }
            }

/**
 * The overall start point for the entire RMI Service for processing the web
 * page data and directing the user to the next page.  There should be 4
 * command line arguments supplied to the program.  The -p arg is the port
 * the service is listening on and the the -r arg is the rmi port that the
 * requests are sent to.  The -i arg is the applications cascading INI file.
 * The -l arg is the logging properties file.
 *
 * @param  argv  the argument vector from the operating system's command line
 */
      public static void main(String[] argv) {
            //Configure the log4j logging system with its appropriate properties file
            PropertyConfigurator.configureAndWatch(getLogFile(argv),300);
            //Load the System wide INI File data using the cascading INI file object
            INIData.load(new File(getIniFilePath(argv)));
            //Tell the system where to find the keystore and its password
            initSSLConnection(INIData.get(KEY_LOCTN), INIData.get(VAL_PSWRD));
            //Start the RMI service running and listening on the given port
            new RequestServer(getHostName(argv), getReceivePort(argv), getSendPort(argv), getServiceName(argv));
            }
      }


/*************************************************************************************/
/*************************************************************************************/
/*************************************************************************************/


/*
 * Set up the logging from the logging properties file
 */
      private void initLogging() {
            PropertyConfigurator.configure(getInitParameter(PROP_CONFIG));
            logInfo = Logger.getLogger(getInitParameter(SRVC_LOGGER));
            }

/*
 * Set up the SSL properties need to make RMI connection
 */
      private void initSystemFlags() {
            System.setProperty("javax.net.debug","ssl,handshake,record");
            System.setProperty(CIPHER_SUIT, SSL_SUITES);
            System.setProperty(CPHR_PRTCLS, SSL_PROTOCOLS);
            System.setProperty(TRUST_STORE, getInitParameter(SSL_TRST_ST));
            System.setProperty(TRUST_PSWRD, getInitParameter(SSL_PASWORD));
            }

/*
 * get the registry values from the web.xml file
 */
      private void initRegistry() {
            try {
                  rmiHost = getInitParameter(RMI_HOST_AD);
                  rmiName = getInitParameter(RMI_SERVICE);
                  rmiPort = Integer.parseInt(getInitParameter(RMI_TCP_PRT));
                  }
            catch(NumberFormatException nfe) {
                  if (logInfo == null) System.err.println("RMI Port Failed to Load: "+nfe.getLocalizedMessage());
                  else logInfo.error("RMI Port Failed to Load: "+nfe.getLocalizedMessage());
                  nfe.printStackTrace();
                  rmiPort = BAD_PORT;
                  }
            }

/*
 * The servlet init function, sets up system values for the servlet
 */
      public void init() {
            try {
                  super.init();
                  initSystemFlags();
                  if (logInfo == null) initLogging();
                  if (rmiPort == BAD_PORT) initRegistry();
                  if (csf == null) csf = new SslRMIClientSocketFactory();
                  }
            catch(ServletException se) {
                  if (logInfo == null) System.err.println("Servlet Single Sign On Failed to Initialize: "+se.getLocalizedMessage());
                  else logInfo.error("Servlet Single Sign On Failed to Initialize: "+se.getLocalizedMessage());
                  se.printStackTrace();
                  }
            }

/*************************************************************************************/


/*
 * The RMI Call to the Request Handler service behind the fire wall
 *
 * @param   data  the data for the request
 *
 * @return  a request response object
 *
 */
      private Response getRequest(Datatable data) {
            Registry      registry = null;
            Response       response = null;
            Request       request = null;

            try {
                  logInfo.debug("Call RMI: "+rmiHost+":"+rmiPort+"/"+rmiName);
                  //locate the registy
                  registry = LocateRegistry.getRegistry(rmiHost, rmiPort, csf);
                  //find the request handler
                  request  = (Request)registry.lookup(rmiName);
                  //get the response from the request handler
                  response = request.handle(data);
                  logInfo.debug("Response: "+response);
                  }
            catch(NotBoundException nbe) {
                  //print out the exception stack trace
                  nbe.printStackTrace();
                  //log the error that occurred
                  logInfo.error("Could Not Locate RMI Service: "+nbe.getLocalizedMessage());
                  //Build the default response object
                  response = (new Response(Response.PAGE_NO_RMI_ERROR, data));
                  }
            catch(RemoteException re) {
                  //print out the exception stack trace
                  re.printStackTrace();
                  //log the error that occurred
                  logInfo.error("Could Not Create RMI Socket Connection: "+re.getLocalizedMessage());
                  //Build the default response object
                  response = (new Response(Response.PAGE_NO_RMI_ERROR, data));
                  }
            catch(Exception excp) {
                  //print out the exception stack trace
                  excp.printStackTrace();
                  //log the error that occurred
                  logInfo.error("Unforeseen Exception in RMI Call: "+excp.getLocalizedMessage());
                  //Build the default response object
                  response = (new Response(Response.PAGE_NO_RMI_ERROR, data));
                  }
            //return the response
            return response;
            }

     private static final String[] SSL_PROTOCOLS = {"SSLv3"};
      private static final String[] SSL_SUITES = {"SSL_RSA_WITH_NULL_SHA"};

think they should be:

      private static final String SSL_PROTOCOLS = "SSLv3";
      private static final String SSL_SUITES = "SSL_RSA_WITH_NULL_SHA";

According to the Java Doc for SSL RMI Server Socket Factory, the enabled cipher suites and protocols are both string arrays:

SslRMIServerSocketFactory(String[] enabledCipherSuites,
                     String[] enabledProtocols,
                     boolean needClientAuth);

ah, didn't see you using them there as well.

then your problem is with:

            System.setProperty(CIPHER_SUIT, SSL_SUITES);
            System.setProperty(CPHR_PRTCLS, SSL_PROTOCOLS);

should be:

            System.setProperty(CIPHER_SUIT, "SSL_RSA_WITH_NULL_SHA");
            System.setProperty(CPHR_PRTCLS, "SSLv3");

OK, I see the point of confusion.   All the code below the three lines of stars is from the servlet that acts as the client for the RMI Service.  Unfortunately I can't put the entire servlet up because it contains to much proprietary information.  In the servlet the definitions are:

      private static final String      SSL_PROTOCOLS = "SSLv3";
      private static final String      SSL_SUITES = "SSL_RSA_WITH_NULL_SHA";

as a test try removing the specification of suite and protocol and see how that goes

That made things worse.

Server side says:
javax.net.ssl.SSLHandshakeException: no cipher suites in common

Client side says:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

do your keystores include the required keys/certs?

We think we have all the necessary required keys, is there a way to verify that?

We did lots of tests today involving our cacerts file.  It seems that the line:

            System.setProperty(TRUST_STORE, getInitParameter(SSL_TRST_ST));

effects all the instances in our cold fusion system.  So this may not be usable with out other applications.  We were able to to create an SSL socket using our cacerts file and some simple ssl client and server code from Sun's web site outside of cold fusion and RMI.  Both the client and server processes had long lists of encryption suites available to then.  They was no problem with the handshaking, the connections were established and the data transferred.  When we run with the RMI service on the server and inside JRun on the client, we still get the "no cipher suite in common message."

> effects all the instances in our cold fusion system.

correct it sets system properties for the whole vm

>  When we run with the RMI service on the server and inside JRun on the client, we still get the "no cipher suite in common message."

Am wondering if the rmi security manager is involved somehow (may well not be)


found this thread that may help
http://forums.sun.com/thread.jspa?threadID=5197672

After long and extensive set test, the problem does appear to have something to doe with RMI.  As per your suggested thread I pulled all the assertions dealing with the suites and protocols, generated a new key.  Basically starting all over, the client side then sent requests with long lists of possible suites.  Did the same on the rmi server side, but still got the "No Ciper Suite In Common" error message.  I've tried it with no suites asserted, a small list of asserted suites and a large list of asserted suites but to no avail, the "No Ciper Suite In Common" error message remains.  Do you have any idea what needs to be changed?

no idea sorry