javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake

[Leela M]

Hi Folks,

I am getting the below exception while trying to invoke an API.
============================================================================
| HTTP
============================================================================
| Step: http GET
----------------------------------------------------------------------------
| Message: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
----------------------------------------------------------------------------
| Trapped Exception: Remote host closed connection during handshake
| Trapped Message: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
----------------------------------------------------------------------------
STACK TRACE
javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:994)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:535)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:403)
at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:177)
at org.apache.http.impl.conn.ManagedClientConnectionImpl.open(ManagedClientConnectionImpl.java:304)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:611)
at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:446)
at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863)
at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:72)
at com.itko.lisa.test.CommTrans.doSend(CommTrans.java:1082)
at com.itko.lisa.test.CommTrans.send(CommTrans.java:851)
at com.itko.lisa.test.CommTrans.sendGET(CommTrans.java:775)
at com.itko.lisa.ws.rest.RESTNode.doSend(RESTNode.java:221)
at com.itko.lisa.ws.rest.RESTNode.doWebTrans(RESTNode.java:171)
at com.itko.lisa.ws.rest.RESTNodeBase.execute(RESTNodeBase.java:380)
at com.itko.lisa.test.TestNode.executeNode(TestNode.java:995)
at com.itko.lisa.test.TestCase.execute(TestCase.java:1297)
at com.itko.lisa.test.TestCase.execute(TestCase.java:1198)
at com.itko.lisa.test.TestCase.executeNextNode(TestCase.java:1183)
at com.itko.lisa.editor.WalkThruPanel.prepAndExecNode(WalkThruPanel.java:1120)
at com.itko.lisa.editor.WalkThruPanel.access$900(WalkThruPanel.java:73)
at com.itko.lisa.editor.WalkThruPanel$10.doCallback(WalkThruPanel.java:1022)
at com.itko.util.swing.panels.ProcessingDialog$2.run(ProcessingDialog.java:195)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.io.EOFException: SSL peer shut down incorrectly
at sun.security.ssl.InputRecord.read(InputRecord.java:505)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:975)
... 26 more
==========================================

Attached is the detailed log.

Also attached the Open ssl command result.

Attachment(s)

SSL Debug Log.txt   42 KB 1 version

OpenSSL_Log.txt   5 KB 1 version

[Sankar Natarajan]

Hi Leela

           There could be several reasons for SSL handshake to fail. To diagnose further, please enable SSL Debug from Workstation and share the SSL Debug log.

--

regards

Sankar Natarajan

[Leela M]

Hi Sankar,
I have already attached the ssl debug log and open ssl command results in the original post. Please let me know if any other data is required.

Following are the steps tried

1. Added https.protocols=TLSv1.2,TLSv1.1,TLSv1,SSLv3  in local.properties-  Didn't work
2. Also added lisa.server.https.cipher.suites=<VALUES> - Didn't work
3. Also tried adding web proxy in the companion of the test case - Didn't work
4.  Also tried importing certs into DevTest jre using the below steps but didn't work either 

• keytool -importcert -alias <Cert> -file \Certs\<<XXX_Cert>>.pem -keystore LISA_HOME\jre\lib\security\cacerts
• keytool -importcert -alias <CBA_SHA>-file \Certs\<<XXX_SHA>.pem -keystore LISA_HOME\jre\lib\security\cacerts
• keytool -importcert -alias <CBA_Issue>-file \Certs\<<XXX_Issue>.pem -keystore LISA_HOME\jre\lib\security\cacerts

5. Created a keystore with an SHA2 certificate and configured it in local.properties with these settings:

ssl.client.cert.path=C:\\Lisa_New\\Data\\keystore\\keystore.jks

ssl.client.cert.pass=password 

ssl.client.key.pass=password 

ssl.client.alias=alias

Developer has asked if the tool supports SNI (Server Name Identification) ,if yes is the default value true?

[Sankar Natarajan]

HI Leela

       Thanks for the log file. Please check your local/lisa/site properties file and disable the properties:

ssl.client.cert.path

ssl.client.cert.pass

Please check the version of java.exe in your devtest env. Just run the command LISA_HOME/jre/bin/java.exe -version. I think the version is 1.8 Update 232. This version supports SNI.

--

regards

Sankar Natarajan

[Vaibhav Jain]

Hi Leela,

Please validate the certificate you are using. Also, identify if the service call require one way or two-way authentication and configure accordingly.

Thanks

------------------------------
Regards,
Vaibhav Jain
Capgemini
------------------------------