I'm currently trying to secure my Grizzly HTTP-Server with SSL (which should be quite easy according to tutorials and examples) - server side only. So first I've downloaded the UnlimitedJCEPolicy from Orcale in order to be able to support strong TLS algorithms. Then I've created a new keystore file with the keytool and the following command:
keytool -keyalg rsa -keysize 2048 -genkey -keystore .\keystore_server.jks -alias server -dname "..." Finally I set up my Server with the following Java code:
//Create Http Server HttpServer server = new HttpServer(); //Configure and register listener NetworkListener adminListener = new NetworkListener("admin", "localhost", 19241); SSLContextConfigurator configurator = new SSLContextConfigurator(); URL url = configurator.getClass().getResource("/keystore_server.jks"); if(url == null) throw new Error("Could not get Keystore!"); configurator.setKeyStoreFile(url.getFile()); configurator.setKeyStorePass("store"); configurator.setKeyPass("key"); configurator.setSecurityProtocol("TLS"); SSLContext context = configurator.createSSLContext(); SSLEngineConfigurator engineConfigurator = new SSLEngineConfigurator(context); engineConfigurator.setWantClientAuth(false); engineConfigurator.setClientMode(true); engineConfigurator.setNeedClientAuth(false); adminListener.setSSLEngineConfig(engineConfigurator); adminListener.setSecure(true); server.addListener(adminListener); Endpoint endpoint = new Endpoint(); EndpointApplication application = new EndpointApplication(endpoint); HttpHandler httpHandler = RuntimeDelegate.getInstance().createEndpoint(application, HttpHandler.class); server.getServerConfiguration().addHttpHandler(httpHandler, "/test"); server.start(); Thanks to Warren, I resolved the first issue not explicitly specifying HTTPS as the protocol to use. However, there is now another problem. Here is the log:
*** ClientHello, TLSv1 RandomCookie: GMT: 1396054606 bytes = { 72, 223, 146, 247, 36, 165, 251, 160, 151, 23, 75, 48, 62, 242, 48, 178, 113, 150, 150, 62, 180, 118, 59, 232, 207, 168, 163, 93 } Session ID: {} Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_RC4_128_SHA, TLS_ECDHE_RSA_WITH_RC4_128_SHA, SSL_RSA_WITH_RC4_128_SHA, TLS_ECDH_ECDSA_WITH_RC4_128_SHA, TLS_ECDH_RSA_WITH_RC4_128_SHA, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_RC4_128_MD5, TLS_EMPTY_RENEGOTIATION_INFO_SCSV] Compression Methods: { 0 } Extension elliptic_curves, curve names: {secp256r1, sect163k1, sect163r2, secp192r1, secp224r1, sect233k1, sect233r1, sect283k1, sect283r1, secp384r1, sect409k1, sect409r1, secp521r1, sect571k1, sect571r1, secp160k1, secp160r1, secp160r2, sect163r1, secp192k1, sect193r1, sect193r2, secp224k1, sect239k1, secp256k1} Extension ec_point_formats, formats: [uncompressed] *** [write] MD5 and SHA1 hashes: len = 163 '...' Grizzly(2) SelectorRunner, WRITE: TLSv1 Handshake, length = 163 [Raw write]: length = 168 '...' [Raw read]: length = 5 '...' [Raw read]: length = 171 '...' Grizzly(2) SelectorRunner, READ: TLSv1 Handshake, length = 171 Grizzly(2) SelectorRunner, fatal error: 80: problem unwrapping net record javax.net.ssl.SSLProtocolException: Handshake message sequence violation, 1 Grizzly(2) SelectorRunner, SEND TLSv1 ALERT: fatal, description = internal_error Grizzly(2) SelectorRunner, WRITE: TLSv1 Alert, length = 2 Is anybody familiar with this type of error?