问题
Followed the instructions here and recreated certificates that I previously incorrectly created. Something has changed as I am now seeing javax.net.ssl.SSLHandshakeException: no cipher suites in common on the server and javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure on the client. Instead of the errors this question
The server is ClassFileServer.java and the respective client SSLSocketClientWithClientAuth.java
Any tips on getting the two ends to play nicely, note that I am using localhost so I would assume the cipher capabilities are the same.
Update:
Here are the steps I have used to generate the files, I may be confusing the key and truststore.:
On the server (following by this guide):
$ keytool -genkey -alias serverkey -keyalg RSA -keypass p@ssw0rd
-storepass p@ssw0rd -keystore keystore.jks
$ keytool -export -alias serverkey -storepass p@ssw0rd -file
server.cer -keystore keystore.jks
$ keytool -import -v -trustcacerts -alias clientkey -file
../client/client.cer -keystore cacerts.jks -keypass p@ssw0rd
-storepass p@ssw0rd
On the client-side (by this guide):
$ keytool -genkey -alias clientkey -keyalg RSA -keypass changeit
-storepass changeit -keystore keystore.jks
$ keytool -export -alias clientkey -storepass changeit -file
client.cer -keystore keystore.jks
$ keytool -import -v -trustcacerts -alias serverkey -file
../server/server.cer -keystore cacerts.jks -keypass changeit
-storepass changeit
Had to use another medium as the debugging exceeded the body limit of this site:
Client debug error: http://pastebin.com/mHCmEqAk
Server debug error: http://pastebin.com/YZbh7H8f
回答1:
javax.net.ssl.SSLHandshakeException: no cipher suites in common
This has two causes:
The server doesn't have a private key and certificate, and possibly doesn't have a keystore at all. In such a case it can only use the insecure anonymous cipher suites, which are disabled by default, and should stay that way. So there is no cipher suite that it can agree to use with the client.
Excessive restrictions on cipher suites imposed by client or server or both such that there can be no agreement.
Re your keystores and truststores, that all looks OK except that you are doing four import steps where you only need two. You don't need to import the server's certificate into the server's own truststore, or the client's certificate into the client's truststore. You only need this:
Server:
$ keytool -import -v -trustcacerts -alias clientkey -file ../client/client.cer -keystore cacerts.jks -keypass p@ssw0rd -storepass p@ssw0rd
Client:
$ keytool -import -v -trustcacerts -alias serverkey -file ../server/server.cer -keystore cacerts.jks -keypass changeit -storepass changeit
and you only need it because you're using a self-signed certificate. Simple solution: don't. Use a CA-signed certificate, which is trusted by the default truststore shipped with Java.
回答2:
I got this error when setting up SSL on a Cassandra cluster. The problem turned out to be in the documentation of version 2.0 when describing generating the keys:
keytool -genkey -alias -keystore .keystore
It omits the specification of RSA as the algorithm, should be (see v1.2 docs):
keytool -genkey -alias -keyalg RSA -keystore .keystore
回答3:
As an alternative to passing trustStores as JVM argument, -Djavax.net.ssl.trustStore=<cacerts_file.jks>, one can also add truststores to SSLContext and then create SSLSocketFactory as the following snippet,
SSLContext ctx;
KeyManagerFactory kmf;
TrustManagerFactory tmf;
KeyStore ks;
TrustManager tm;
ctx = SSLContext.getInstance("TLS");
kmf = KeyManagerFactory.getInstance("SunX509");
ks = KeyStore.getInstance("JKS");
ks.load(new FileInputStream(privateKey), passPhrase.toCharArray());
kmf.init(ks, passphrase);
KeyStore trustKeyStore = KeyStore.getInstance("JKS");
trustKeyStore.load(new FileInputStream(trustStore), trustPassPhrase.toCharArray());
TrustManagerFactory trustMgrFactory = TrustManagerFactory.getInstance("SUNX509");
trustMgrFactory.init(trustKeyStore);
ctx.init(kmf.getKeyManagers(), trustMgrFactory.getTrustManagers(), null);
SSLSocketFactory f = (SSLSocketFactory) ctx.getSocketFactory();
SSLSocket s = (SSLSocket) f.createSocket(serverIp, serverPort);
Note: This client socket does both client as well as server authentication. If you want to disable client authentication, pass null as first argument while initializing SSLContext ctx.
来源：https://stackoverflow.com/questions/9548807/sslhandshakeexception-no-cipher-suites-in-common