OpenJDK8 u352 breaks TLS negotiation
Issue
- Upgrading EAP 7.3 Java to OpenJDK8 u352 causes the HTTPS connection to a backend JBoss Web Server 5.3 (Tomcat 9) to fail with the following exception:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at sun.security.ssl.Alert.createSSLException(Alert.java:131)
at sun.security.ssl.Alert.createSSLException(Alert.java:117)
at sun.security.ssl.TransportContext.fatal(TransportContext.java:311)
at sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293)
at sun.security.ssl.TransportContext.dispatch(TransportContext.java:185)
at sun.security.ssl.SSLTransport.decode(SSLTransport.java JBossWeb/jbcs-httpd24-2.4:152)
at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1397)
at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1305)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
at gov.nasa.sewp.installcert.driver.InstallCert.main(InstallCert.java:69)
Could not obtain server certificate chain
-
After upgrading to the OpenJDK8 u352, the backend server does not negotiate the TLS connection. The
ClientHellois sent and the server immediately sends ahandshake_failurealert instead of theServerHello. -
After upgrading to the OpenJDK8 u352, the Java application making a secure connection to the database fails with the following exception:
javax.net.ssl|WARNING|24|pool-1-thread-1|SSLSocketImpl.java:1542|handling exception (
"throwable" : {
java.lang.RuntimeException: Could not generate ECDH keypair
at sun.security.ssl.ECDHKeyExchange$ECDHEPossession.<init>(ECDHKeyExchange.java:116)
...
Caused by: java.security.InvalidAlgorithmParameterException: unknown curve name: 1.2.840.10045.3.1.7
at org.bouncycastle.jce.provider.JDKKeyPairGenerator$EC.initialize(Unknown Source)
...
javax.net.ssl|FINE|24|pool-1-thread-1|SSLSocketImpl.java:1634|close the SSL connection (initiative)
Failed to get access token: ServiceException(code=MPAYSOA_03400 msg=Error getting token: javax.net.ssl.SSLException: Could not generate ECDH keypair)
javax.net.ssl|SEVERE|2E|HttpConnection-12004-1|TransportContext.java:316|Fatal (HANDSHAKE_FAILURE): Couldn't kickstart handshaking (
"throwable" : {
javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake
...
Caused by: java.io.EOFException: SSL peer shut down incorrectly
...
javax.net.ssl|FINE|2E|HttpConnection-12004-1|SSLSocketOutputRecord.java:71|WRITE: TLS12 alert(handshake_failure), length = 2
Environment
- OpenJDK8 u352
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.