java1.7请求https接口报协议版本错误

记录 java 请求接口报 Received fatal alert: protocol_version)错误的处理方法

# 背景

最近公司项目接到合作方反馈某接口出现调不通的问题，错误信息：

Received fatal alert: protocol_version

发现是客户端与服务端 tls 协议版本不一致导致。
服务器使用的是 1.7 版本的 Java，考虑到做 jdk 整体版本升级风险会比较大，所以选择在代码层做绕过。

# 解决方法

在代码中增加绕过的操作，新建如下三个文件：

HttpTest 测试类：

package httpClient;

import java.io.BufferedReader;
import java.io.InputStream;
import java.io.InputStreamReader;
import java.io.OutputStreamWriter;
import java.net.HttpURLConnection;
import java.net.URL;

import javax.net.ssl.HttpsURLConnection;

public class HttpTest {

    public static void main(String[] args) {
        HttpURLConnection con = null;
        BufferedReader buffer = null;
        StringBuffer resultBuffer = null;

        try {
            URL url = new URL("https://xxx.com/xx");

            // 得到连接对象
            con = (HttpURLConnection) url.openConnection();
            // 设置请求类型
            con.setRequestMethod("POST");
            // 设置Content-Type，此处根据实际情况确定
            con.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");

            if (con instanceof HttpsURLConnection) {
                // 注释掉之后java1.7会报错
                SSLContext sc = SSLContext.getInstance("TLSv1.2");
                sc.init(null, new TrustManager[] { new TrustAnyTrustManager() }, new java.security.SecureRandom());
                ((HttpsURLConnection) con).setSSLSocketFactory(sc.getSocketFactory());
                ((HttpsURLConnection) con).setHostnameVerifier(new TrustAnyHostnameVerifier());

            }

            // 允许写出
            con.setDoOutput(true);
            // 允许读入
            con.setDoInput(true);
            // 不使用缓存
            con.setUseCaches(false);
            OutputStreamWriter out = new OutputStreamWriter(con.getOutputStream(), "UTF-8");
            out.append("code=ccc");
            out.flush();
            // 得到响应码
            int responseCode = con.getResponseCode();
            if (responseCode == HttpURLConnection.HTTP_OK) {
                // 得到响应流
                InputStream inputStream = con.getInputStream();
                // 将响应流转换成字符串
                resultBuffer = new StringBuffer();
                String line;
                buffer = new BufferedReader(new InputStreamReader(inputStream, "GBK"));
                while ((line = buffer.readLine()) != null) {
                    resultBuffer.append(line);
                }
                System.out.println("result:" + resultBuffer.toString());
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}

TrustAnyHostnameVerifier 类文件：

package httpClient;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSession;

public class TrustAnyHostnameVerifier implements HostnameVerifier {
    public boolean verify(String hostname, SSLSession session) {
        // 直接Pass
        return true;
    }
}

TrustAnyTrustManager 类文件：

package httpClient;

import javax.net.ssl.X509TrustManager;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

public class TrustAnyTrustManager implements X509TrustManager {

    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
    }

    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
    }

    public X509Certificate[] getAcceptedIssuers() {
        return new X509Certificate[] {};
    }
}

# 测试

测试命令，分别用 jdk 1.7、1.8 进行测试：

// 编译
javac httpClient/HttpTest.java

// 运行
/usr/bin/env /Library/Java/JavaVirtualMachines/jdk1.7.0_80.jdk/Contents/Home/bin/java httpClient/HttpTest

/usr/bin/env /Library/Java/JavaVirtualMachines/jdk1.8.0_211.jdk/Contents/Home/bin/java httpClient/HttpTest

如果使用 1.7 则会出现如下结果：

javax.net.ssl.SSLException: Received fatal alert: protocol_version
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
        at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1979)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1086)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1332)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1359)
        at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1343)
        at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
        at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
        at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1092)
        at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
        at httpClient.HttpTest.main(HttpTest.java:54)

# 原因分析

1.7 默认使用的 1.1 tls 协议进行握手连接，服务端如果使用 1.2 的tls 则会出现协议不匹配的错误导致握手失败，从而无法正常发出请求。

# 背景

# 解决方法

# 测试

# 原因分析

# 参考资料

Recommend

专栏总结java1：类型和String、反射

微信小程序开发实战（21）：发起HTTPS请求

mac环境下使用Charles抓包Https请求

SpringBoot之https请求

使用Fiddler把请求从HTTPS改成HTTP

在Android手机上对https请求进行抓包

折腾老设备的 HTTPS 请求问题

python请求设置TSL协议版本

onvif 接口 http 协议 C++ 版本 tiandy_onvif_http_C++

Java1.8项目纤程实战和性能压测

About Joyk