QuickFIX/J连接报错：证书不符合算法约束求助

问题概述 #

基于Java 17开发QuickFIX/J应用，使用JKS证书与外部合作方建立安全连接时，触发java.security.cert.CertificateException错误，提示Certificates do not conform to algorithm constraints。

环境信息 #

• QuickFIX/J版本：2.3.1
• Java版本：17
• 核心错误：java.security.cert.CertificateException: Certificates do not conform to algorithm constraints

我的QuickFIX/J配置 #

ConnectionType=initiator
SocketConnectHost=my_ip
SocketConnectPort=my_port
SocketUseSSL=Y
CipherSuites=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
EnabledProtocols=TLSv1.2
SocketKeyStore=/path/cert.jks
SocketKeyStorePassword=my_passowrd
SocketTrustStore=/path-trust/truststore.jks
SocketTrustStorePassword=my_password

错误堆栈信息 #

javax.net.ssl|ERROR|A2|NioProcessor-2|2024-05-08 16:28:46.528 BRT|TransportContext.java:370|Fatal (UNSUPPORTED_CERTIFICATE): Certificates do not conform to algorithm constraints (
"throwable" : {
  java.security.cert.CertificateException: Certificates do not conform to algorithm constraints
    at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(SSLContextImpl.java:1573)
    at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:1538)
    at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:1456)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:632)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
    at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
    at java.base/sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:396)
    at java.base/sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:480)
    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1277)
    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:1264)
    at java.base/java.security.AccessController.doPrivileged(AccessController.java:712)
    at java.base/sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:1209)
    at org.apache.mina.filter.ssl.SslHandler.doTasks(SslHandler.java:816)
    at org.apache.mina.filter.ssl.SslHandler.handshake(SslHandler.java:591)
    at org.apache.mina.filter.ssl.SslHandler.messageReceived(SslHandler.java:356)
    at org.apache.mina.filter.ssl.SslFilter.messageReceived(SslFilter.java:517)
    at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:650)
    at org.apache.mina.core.filterchain.DefaultIoFilterChain.access$1300(DefaultIoFilterChain.java:49)
    at org.apache.mina.core.filterchain.DefaultIoFilterChain$EntryImpl$1.messageReceived(DefaultIoFilterChain.java:1128)
    at org.apache.mina.core.filterchain.IoFilterAdapter.messageReceived(IoFilterAdapter.java:122)
    at org.apache.mina.core.filterchain.DefaultIoFilterChain.callNextMessageReceived(DefaultIoFilterChain.java:650)
    at org.apache.mina.core.filterchain.DefaultIoFilterChain.fireMessageReceived(DefaultIoFilterChain.java:643)
    at org.apache.mina.core.polling.AbstractPollingIoProcessor.read(AbstractPollingIoProcessor.java:539)
    at org.apache.mina.core.polling.AbstractPollingIoProcessor.access$1200(AbstractPollingIoProcessor.java:68)
    at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.process(AbstractPollingIoProcessor.java:1224)
    at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.process(AbstractPollingIoProcessor.java:1213)
    at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:683)
    at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
    at java.base/java.lang.Thread.run(Thread.java:840)
  Caused by: java.security.cert.CertPathValidatorException: Algorithm constraints check failed on signature algorithm: SHA1withRSA
    at java.base/sun.security.provider.certpath.AlgorithmChecker.check(AlgorithmChecker.java:237)
    at java.base/sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraints(SSLContextImpl.java:1569)
    ... 30 more}

合作方连接要求 #

合作方指定的加密套件：

• TLS_ECDHE_RSA_AES_256_GCM_SHA384
• TLS_ECDHE_RSA_AES_256_CBC_SHA384
• TLS_ECDHE_RSA_AES_128_CBC_SHA256

合作方连接要求详情：

解决建议 #

1. 修正加密套件配置 #

当前配置的加密套件名称与合作方要求存在差异：你配置的是TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384，合作方要求的是TLS_ECDHE_RSA_AES_256_GCM_SHA384（缺少WITH）。更新配置为合作方指定的所有加密套件：

CipherSuites=TLS_ECDHE_RSA_AES_256_GCM_SHA384,TLS_ECDHE_RSA_AES_256_CBC_SHA384,TLS_ECDHE_RSA_AES_128_CBC_SHA256

2. 处理SHA1签名算法限制 #

错误堆栈显示问题根源是合作方证书使用了SHA1withRSA签名算法，而Java 17默认禁用该算法的证书验证，可通过以下方式处理：

• 生产环境推荐：联系合作方更换使用SHA-256及以上签名算法的合规证书，从根本解决安全问题。
• 测试环境临时方案：
  • 修改Java安全配置文件java.security（位于JRE/lib/security或JDK/conf/security目录），找到jdk.certpath.disabledAlgorithms项，移除其中的SHA1条目，示例：

    jdk.certpath.disabledAlgorithms=MD2, MD5, RSA keySize < 1024
    

  • 或通过JVM启动参数临时放宽约束：

    -Djdk.certpath.disabledAlgorithms="MD2, MD5, RSA keySize < 1024"
    -Djdk.tls.disabledAlgorithms="SSLv3, TLSv1, TLSv1.1, RC4, DES, MD5withRSA, DH keySize < 1024, EC keySize < 224, 3DES_EDE_CBC, anon, NULL"
    

内容的提问来源于stack exchange，提问作者Felipe Windmoller