我今天从Java 1.6升级到Java 1.7。从那时起,当我尝试通过SSL建立到我的Web服务器的连接时发生错误:
javax.net.ssl.SSLProtocolException: handshake alert: unrecognized_name at sun.security.ssl.ClientHandshaker.handshakeAlert(ClientHandshaker.java:1288) at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1904) at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1027) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1262) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1289) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1273) at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:523) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185) at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1296) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:254) at java.net.URL.openStream(URL.java:1035)
这是代码:
SAXBuilder builder = new SAXBuilder(); Document document = null; try { url = new URL(https://some url); document = (Document) builder.build(url.openStream()); } catch (NoSuchAlgorithmException ex) { Logger.getLogger(DownloadLoadiciousComputer.class.getName()).log(Level.SEVERE, null, ex); }
这只是一个测试项目,这就是为什么我允许和使用不受信任的证书以及代码的原因:
TrustManager[] trustAllCerts = new TrustManager[]{ new X509TrustManager() { public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } public void checkClientTrusted( java.security.cert.X509Certificate[] certs, String authType) { } public void checkServerTrusted( java.security.cert.X509Certificate[] certs, String authType) { } } }; try { SSLContext sc = SSLContext.getInstance("SSL"); sc.init(null, trustAllCerts, new java.security.SecureRandom()); HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); } catch (Exception e) { Logger.getLogger(DownloadManager.class.getName()).log(Level.SEVERE, null, e); }
Java 7引入了默认情况下启用的SNI支持。我发现某些配置错误的服务器会在SSL握手中发送“无法识别的名称”警告,大多数客户端会忽略此警告… Java除外。如@Bob Kerns所述,Oracle工程师拒绝“修复”此错误/功能。
解决方法是,他们建议设置jsse.enableSNIExtension属性。要使你的程序无需重新编译即可运行,请按以下方式运行你的应用程序:
jsse.enableSNIExtension
java -Djsse.enableSNIExtension=false yourClass
也可以在Java代码中设置该属性,但是必须在任何SSL操作之前设置该属性。加载SSL库后,你可以更改属性,但不会对SNI status 产生任何影响。要在运行时禁用SNI(具有上述限制),请使用:
System.setProperty("jsse.enableSNIExtension", "false");
设置此标志的缺点是SNI在应用程序中的任何地方都被禁用。为了利用SNI并仍然支持配置错误的服务器:
SSLSocket
sslsock
sslsock.startHandshake()
startHandshake()
handshake alert: unrecognized_name
unrecognized_name