We have a system where a Java servlet on is connecting to an RMI service with no problem. We need to upgrade the security of the RMI calls to use SSL. Currently when the servlet attempts to contact the RMI service the handshaking fails with a "no cipher suites in common". The problem is there is a common suite, SSL_RSA_WITH_NULL_SHA, so I am thinking this is a permission or security settings problem. I don't know which file to edit and what value to set to get the handshaking to complete successfully.
The following is a listing from the RMI service side of the process.
STATUS | wrapper | 2009/02/09 16:05:22 | --> Wrapper Started as Service
STATUS | wrapper | 2009/02/09 16:05:22 | Launching a JVM...
INFO | jvm 1 | 2009/02/09 16:05:24 | WrapperManager class initialized by thread: main Using classloader: sun.misc.Launcher$AppClass
Loader@11b
86e7
INFO | jvm 1 | 2009/02/09 16:05:24 | Wrapper (Version 3.2.3)
http://wrapper.tanukisoftware.orgINFO | jvm 1 | 2009/02/09 16:05:24 | Copyright 1999-2006 Tanuki Software, Inc. All Rights Reserved.
INFO | jvm 1 | 2009/02/09 16:05:24 |
INFO | jvm 1 | 2009/02/09 16:05:24 | Wrapper Manager: JVM #1
INFO | jvm 1 | 2009/02/09 16:05:24 | Running a 32-bit JVM.
INFO | jvm 1 | 2009/02/09 16:05:24 | Wrapper Manager: Registering shutdown hook
INFO | jvm 1 | 2009/02/09 16:05:24 | Wrapper Manager: Using wrapper
INFO | jvm 1 | 2009/02/09 16:05:24 | Load native library. One or more attempts may fail if platform specific libraries do not exist.
INFO | jvm 1 | 2009/02/09 16:05:24 | Loading native library failed: wrapper-windows-x86-32.dll
Cause: java.lang.UnsatisfiedLinkE
rror: no wrapper-windows-x86-32 in java.library.path
INFO | jvm 1 | 2009/02/09 16:05:24 | Loaded native library: wrapper.dll
INFO | jvm 1 | 2009/02/09 16:05:24 | Calling native initialization method.
INFO | jvm 1 | 2009/02/09 16:05:24 | Initializing WrapperManager native library.
INFO | jvm 1 | 2009/02/09 16:05:24 | Java Executable: D:\Program Files\Java\jre1.6.0_05\bin
\java.exe
INFO | jvm 1 | 2009/02/09 16:05:24 | Windows version: 5.2.3790
INFO | jvm 1 | 2009/02/09 16:05:24 | Java Version : 1.6.0_05-b13 Java HotSpot(TM) Client VM
INFO | jvm 1 | 2009/02/09 16:05:24 | Java VM Vendor : Sun Microsystems Inc.
INFO | jvm 1 | 2009/02/09 16:05:24 |
INFO | jvm 1 | 2009/02/09 16:05:24 | Control event monitor thread started.
INFO | jvm 1 | 2009/02/09 16:05:24 | Startup runner thread started.
INFO | jvm 1 | 2009/02/09 16:05:24 | WrapperManager.start(org.t
anukisoftw
are.wrappe
r.WrapperS
impleApp@1
bf73fa, args["-inif", "D:\fsbdev\ini\start.ini",
"-logr", "D:\fsbdev\ini\rmilog.prop
erties", "-recv", "1099", "-send", "1152", "-name", "DevRequestProcessor"]) called by thread: main
INFO | jvm 1 | 2009/02/09 16:05:24 | Communications runner thread started.
INFO | jvm 1 | 2009/02/09 16:05:24 | Open socket to wrapper...Wrapper-Connecti
on
INFO | jvm 1 | 2009/02/09 16:05:24 | Failed attempt to bind using local port 31000
INFO | jvm 1 | 2009/02/09 16:05:24 | Opened Socket from 31001 to 32000
INFO | jvm 1 | 2009/02/09 16:05:24 | Send a packet KEY : YP65aPGNpcPP_Vve
INFO | jvm 1 | 2009/02/09 16:05:24 | handleSocket(Socket[addr=/
127.0.0.1,
port=32000
,localport
=31001])
INFO | jvm 1 | 2009/02/09 16:05:24 | Received a packet LOW_LOG_LEVEL : 1
INFO | jvm 1 | 2009/02/09 16:05:24 | Wrapper Manager: LowLogLevel from Wrapper is 1
INFO | jvm 1 | 2009/02/09 16:05:24 | Received a packet PING_TIMEOUT : 30
INFO | jvm 1 | 2009/02/09 16:05:24 | PingTimeout from Wrapper is 30000
INFO | jvm 1 | 2009/02/09 16:05:24 | Received a packet PROPERTIES : (Property Values)
INFO | jvm 1 | 2009/02/09 16:05:24 | Received a packet START : start
INFO | jvm 1 | 2009/02/09 16:05:24 | calling WrapperListener.start()
INFO | jvm 1 | 2009/02/09 16:05:24 | Waiting for WrapperListener.start runner thread to complete.
INFO | jvm 1 | 2009/02/09 16:05:24 | WrapperListener.start runner thread started.
INFO | jvm 1 | 2009/02/09 16:05:24 | WrapperSimpleApp: start(args) Will wait up to 2 seconds for the main method to complete.
INFO | jvm 1 | 2009/02/09 16:05:24 | WrapperSimpleApp: invoking main method
INFO | jvm 1 | 2009/02/09 16:05:24 | Read INI: D:\fsbdev\ini\start.ini
INFO | jvm 1 | 2009/02/09 16:05:25 | Send a packet START_PENDING : 5000
INFO | jvm 1 | 2009/02/09 16:05:26 | Read: D:\fsbdev\ini\action.ini
INFO | jvm 1 | 2009/02/09 16:05:26 | Read: D:\fsbdev\ini\communicator
.ini
INFO | jvm 1 | 2009/02/09 16:05:26 | Read: D:\fsbdev\ini\database.ini
INFO | jvm 1 | 2009/02/09 16:05:26 | Send a packet START_PENDING : 5000
INFO | jvm 1 | 2009/02/09 16:05:26 | WrapperSimpleApp: start(args) end. Main Completed=false, exitCode=null
INFO | jvm 1 | 2009/02/09 16:05:26 | WrapperListener.start runner thread stopped.
INFO | jvm 1 | 2009/02/09 16:05:26 | returned from WrapperListener.start()
INFO | jvm 1 | 2009/02/09 16:05:26 | Send a packet STARTED :
INFO | jvm 1 | 2009/02/09 16:05:26 | Startup runner thread stopped.
INFO | jvm 1 | 2009/02/09 16:05:26 | Read: D:\fsbdev\ini\mail.ini
INFO | jvm 1 | 2009/02/09 16:05:26 | Read: D:\fsbdev\ini\messages.ini
INFO | jvm 1 | 2009/02/09 16:05:26 | Store: D:\Program Files\Java\jre1.6.0_05\lib
\security\
cacerts
INFO | jvm 1 | 2009/02/09 16:05:26 | Get Request Object with SSL
INFO | jvm 1 | 2009/02/09 16:05:26 | keyStore is : D:\Program Files\Java\jre1.6.0_05\lib
\security\
cacerts
INFO | jvm 1 | 2009/02/09 16:05:26 | keyStore type is : jks
INFO | jvm 1 | 2009/02/09 16:05:26 | keyStore provider is :
INFO | jvm 1 | 2009/02/09 16:05:26 | init keystore
INFO | jvm 1 | 2009/02/09 16:05:27 | Received a packet PING : ping
INFO | jvm 1 | 2009/02/09 16:05:27 | Send a packet PING : ok
INFO | jvm 1 | 2009/02/09 16:05:27 | init keymanager of type SunX509
INFO | jvm 1 | 2009/02/09 16:05:27 | trustStore is: D:\Program Files\Java\jre1.6.0_05\lib
\security\
cacerts
INFO | jvm 1 | 2009/02/09 16:05:27 | trustStore type is : jks
INFO | jvm 1 | 2009/02/09 16:05:27 | trustStore provider is :
INFO | jvm 1 | 2009/02/09 16:05:27 | init truststore
<long list of trusted certs being added>
INFO | jvm 1 | 2009/02/09 16:05:27 | trigger seeding of SecureRandom
INFO | jvm 1 | 2009/02/09 16:05:27 | done seeding SecureRandom
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPE
ndpoint <clinit>
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: WrapperSimpleAppMain: localHostKnown = true, localHost = 172.20.110.137
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPT
ransport <init>
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: WrapperSimpleAppMain: Version = 2, ep = [172.20.110.137:1152,javax
.rmi.ssl.S
slRMIServe
rSocketFac
tory@62a94
85b,javax.
rmi.ssl.Ss
lRMIClient
SocketFact
ory@1bd266
4]
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPE
ndpoint getLocalEndpoint
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: WrapperSimpleAppMain: created local endpoint for socket factory javax.rmi.ssl.SslRMIServer
SocketFact
ory@62a948
5b on port 1152
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPT
ransport listen
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: WrapperSimpleAppMain: (port 1152) create server socket
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPE
ndpoint newServerSocket
INFO | jvm 1 | 2009/02/09 16:05:27 | FINER: WrapperSimpleAppMain: creating server socket on [172.20.110.137:1152,javax
.rmi.ssl.S
slRMIServe
rSocketFac
tory@62a94
85b,javax.
rmi.ssl.Ss
lRMIClient
SocketFact
ory@1bd266
4]
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPT
ransport$A
cceptLoop executeAcceptLoop
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: RMI TCP Accept-1152: listening on port 1152
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPT
ransport <init>
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: WrapperSimpleAppMain: Version = 2, ep = [172.20.110.137:0]
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPE
ndpoint getLocalEndpoint
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: WrapperSimpleAppMain: created local endpoint for socket factory null on port 0
INFO | jvm 1 | 2009/02/09 16:05:27 | Finalizer, called close()
INFO | jvm 1 | 2009/02/09 16:05:27 | Finalizer, called closeInternal(true)
INFO | jvm 1 | 2009/02/09 16:05:27 | *** 1 Suite: SSL_RSA_WITH_NULL_SHA
INFO | jvm 1 | 2009/02/09 16:05:27 | *** 1 Proto: SSLv3
INFO | jvm 1 | 2009/02/09 16:05:27 | *** Locate Registry ***
INFO | jvm 1 | 2009/02/09 16:05:27 | *** Rebind: RegistryImpl_Stub[UnicastR
ef [liveRef: [endpoint:[172.20.110.137:
1099](remo
te),objID:
[0:0:0, 0]]]]
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPC
hannel createConnection
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: WrapperSimpleAppMain: create connection
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.tcp.TCPE
ndpoint newSocket
INFO | jvm 1 | 2009/02/09 16:05:27 | FINER: WrapperSimpleAppMain: opening socket to [172.20.110.137:1099]
INFO | jvm 1 | 2009/02/09 16:05:27 | Feb 9, 2009 4:05:27 PM sun.rmi.transport.proxy.RM
IMasterSoc
ketFactory
createSocket
INFO | jvm 1 | 2009/02/09 16:05:27 | FINE: WrapperSimpleAppMain: host: 172.20.110.137, port: 1099
INFO | jvm 1 | 2009/02/09 16:05:28 | *** Connection refused to host: 172.20.110.137; nested exception is:
INFO | jvm 1 | 2009/02/09 16:05:28 | java.net.ConnectException:
Connection refused: connect ***
INFO | jvm 1 | 2009/02/09 16:05:28 | *** Create ***
INFO | jvm 1 | 2009/02/09 16:05:28 | Feb 9, 2009 4:05:28 PM sun.rmi.transport.tcp.TCPT
ransport <init>
INFO | jvm 1 | 2009/02/09 16:05:28 | FINE: WrapperSimpleAppMain: Version = 2, ep = [172.20.110.137:1099,javax
.rmi.ssl.S
slRMIServe
rSocketFac
tory@62a94
85b,javax.
rmi.ssl.Ss
lRMIClient
SocketFact
ory@1bd266
4]
INFO | jvm 1 | 2009/02/09 16:05:28 | Feb 9, 2009 4:05:28 PM sun.rmi.transport.tcp.TCPE
ndpoint getLocalEndpoint
INFO | jvm 1 | 2009/02/09 16:05:28 | FINE: WrapperSimpleAppMain: created local endpoint for socket factory javax.rmi.ssl.SslRMIServer
SocketFact
ory@62a948
5b on port 1099
INFO | jvm 1 | 2009/02/09 16:05:28 | Feb 9, 2009 4:05:28 PM sun.rmi.transport.tcp.TCPT
ransport listen
INFO | jvm 1 | 2009/02/09 16:05:28 | FINE: WrapperSimpleAppMain: (port 1099) create server socket
INFO | jvm 1 | 2009/02/09 16:05:28 | Feb 9, 2009 4:05:28 PM sun.rmi.transport.tcp.TCPE
ndpoint newServerSocket
INFO | jvm 1 | 2009/02/09 16:05:28 | FINER: WrapperSimpleAppMain: creating server socket on [172.20.110.137:1099,javax
.rmi.ssl.S
slRMIServe
rSocketFac
tory@62a94
85b,javax.
rmi.ssl.Ss
lRMIClient
SocketFact
ory@1bd266
4]
INFO | jvm 1 | 2009/02/09 16:05:28 | Feb 9, 2009 4:05:28 PM sun.rmi.transport.tcp.TCPT
ransport$A
cceptLoop executeAcceptLoop
INFO | jvm 1 | 2009/02/09 16:05:28 | FINE: RMI TCP Accept-1099: listening on port 1099
INFO | jvm 1 | 2009/02/09 16:05:28 | *** Bind ***
INFO | jvm 1 | 2009/02/09 16:05:28 | *** 2 Suite: SSL_RSA_WITH_NULL_SHA
INFO | jvm 1 | 2009/02/09 16:05:28 | *** 2 Proto: SSLv3
INFO | jvm 1 | 2009/02/09 16:05:28 | Bound DevRequestProcessor on 172.20.110.137 to 1099
INFO | jvm 1 | 2009/02/09 16:05:28 | WrapperSimpleApp: main method completed
<servlet makes RMI over SSL Call>
INFO | jvm 1 | 2009/02/09 16:06:46 | RMI TCP Connection(1)-172.20.195.5
6, setSoTimeout(7200000) called
INFO | jvm 1 | 2009/02/09 16:06:46 | RMI TCP Connection(1)-172.20.195.5
6, READ: SSLv3 Handshake, length = 45
INFO | jvm 1 | 2009/02/09 16:06:46 | *** ClientHello, SSLv3
INFO | jvm 1 | 2009/02/09 16:06:46 | RandomCookie: GMT: 1217370608 bytes = { 228, 170, 154, 51, 122, 60, 106, 28, 153, 102, 67, 220, 50, 137, 209, 143, 7, 242, 36, 110, 142, 7, 94, 142, 167, 123, 23, 206 }
INFO | jvm 1 | 2009/02/09 16:06:46 | Session ID: {}
INFO | jvm 1 | 2009/02/09 16:06:46 | Cipher Suites: [SSL_RSA_WITH_NULL_SHA]
INFO | jvm 1 | 2009/02/09 16:06:46 | Compression Methods: { 0 }
INFO | jvm 1 | 2009/02/09 16:06:46 | ***
INFO | jvm 1 | 2009/02/09 16:06:46 | RMI TCP Connection(1)-172.20.195.5
6, SEND SSLv3 ALERT: fatal, description = handshake_failure
INFO | jvm 1 | 2009/02/09 16:06:46 | RMI TCP Connection(1)-172.20.195.5
6, WRITE: SSLv3 Alert, length = 2
INFO | jvm 1 | 2009/02/09 16:06:46 | RMI TCP Connection(1)-172.20.195.5
6, called closeSocket()
INFO | jvm 1 | 2009/02/09 16:06:46 | RMI TCP Connection(1)-172.20.195.5
6, handling exception: javax.net.ssl.SSLHandshake
Exception:
no cipher suites in common
INFO | jvm 1 | 2009/02/09 16:06:46 | Feb 9, 2009 4:06:46 PM sun.rmi.transport.tcp.TCPT
ransport$C
onnectionH
andler run0
INFO | jvm 1 | 2009/02/09 16:06:46 | FINE: RMI TCP Connection(1)-172.20.195.5
6: terminated with exception:
INFO | jvm 1 | 2009/02/09 16:06:46 | javax.net.ssl.SSLHandshake
Exception:
no cipher suites in common
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.Alerts.
getSSLExce
ption(Unkn
own Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.SSLSock
etImpl.fat
al(Unknown
Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.Handsha
ker.fatalS
E(Unknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.Handsha
ker.fatalS
E(Unknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.ServerH
andshaker.
chooseCiph
erSuite(Un
known Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.ServerH
andshaker.
clientHell
o(Unknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.ServerH
andshaker.
processMes
sage(Unkno
wn Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.Handsha
ker.proces
sLoop(Unkn
own Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.Handsha
ker.proces
s_record(U
nknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.SSLSock
etImpl.rea
dRecord(Un
known Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.SSLSock
etImpl.per
formInitia
lHandshake
(Unknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.SSLSock
etImpl.rea
dDataRecor
d(Unknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at com.sun.net.ssl.internal.s
sl.AppInpu
tStream.re
ad(Unknown
Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at java.io.BufferedInputStrea
m.fill(Unk
nown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at java.io.BufferedInputStrea
m.read(Unk
nown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at java.io.DataInputStream.re
adInt(Unkn
own Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at sun.rmi.transport.tcp.TCPT
ransport$C
onnectionH
andler.run
0(Unknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at sun.rmi.transport.tcp.TCPT
ransport$C
onnectionH
andler.run
(Unknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at java.util.concurrent.Threa
dPoolExecu
tor$Worker
.runTask(U
nknown Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at java.util.concurrent.Threa
dPoolExecu
tor$Worker
.run(Unkno
wn Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | at java.lang.Thread.run(Unkno
wn Source)
INFO | jvm 1 | 2009/02/09 16:06:46 | RMI TCP Connection(1)-172.20.195.5
6, called close()
INFO | jvm 1 | 2009/02/09 16:06:46 | RMI TCP Connection(1)-172.20.195.5
6, called closeInternal(true)
Note also, we are using Tanukisoft's Javawrapper to run the rmi service as a windows service.