Java 8 SpringBoot连接HTTPS服务器报Unsupported curve:1.2.840.10045.3.1.7异常求助

问题详情 #

基于Java 8（JDK 1.8.0_202）的SpringBoot应用连接HTTPS服务器时抛出握手异常：

javax.net.ssl.SSLHandshakeException: Unsupported curve: 1.2.840.10045.3.1.7

该OID对应的是**secp256r1（NIST P-256）**椭圆曲线，属于Java 8默认支持的加密曲线。

环境信息 #

• 操作系统：CentOS Linux release 7.3.1611 (Core)
• 内核版本：5.4.54-1.0.0.std7c.el7.2.x86_64
• JDK版本：jdk1.8.0_202

异常栈片段 #

Caused by: javax.net.ssl.SSLHandshakeException: Unsupported curve: 1.2.840.10045.3.1.7
    at sun.security.ssl.HandshakeMessage$ECDH_ServerKeyExchange.<init>(HandshakeMessage.java:1068)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:300)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:965)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1064)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)

已确认的Cipher套件 #

应用已验证JDK支持的Cipher套件包含EC相关套件（如TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256等）。

解决方案 #

1. 验证JCE无限制策略文件 #

JDK 8u161及以后默认包含无限制强度加密策略，但部分定制版JDK可能移除该组件。检查$JAVA_HOME/jre/lib/security目录下是否存在local_policy.jar和US_export_policy.jar，且为无限制版本。若缺失，替换为对应JDK版本的无限制策略文件。

2. 手动指定支持的椭圆曲线 #

在构建SSLContext或HttpClient时，明确指定启用secp256r1曲线，示例代码（基于Apache HttpClient）：

import org.apache.http.client.HttpClient;
import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
import org.apache.http.conn.ssl.SSLContexts;
import org.apache.http.impl.client.HttpClients;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import java.security.SecureRandom;

public class SSLClientConfig {
    public static HttpClient createCustomHttpClient() throws Exception {
        SSLContext sslContext = SSLContexts.custom()
                .setSecureRandom(new SecureRandom())
                .build();

        SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(
                sslContext,
                new String[]{"TLSv1.2"},
                new String[]{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"},
                (hostname, session) -> true,
                (socket, targetHost) -> {
                    if (socket instanceof SSLSocket) {
                        SSLSocket sslSocket = (SSLSocket) socket;
                        sslSocket.setEnabledCurves(new String[]{"secp256r1"});
                        sslSocket.setEnabledProtocols(new String[]{"TLSv1.2"});
                        sslSocket.setEnabledCipherSuites(new String[]{"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"});
                    }
                }
        );

        return HttpClients.custom()
                .setSSLSocketFactory(sslSocketFactory)
                .build();
    }
}

3. 升级系统OpenSSL库 #

CentOS 7默认的OpenSSL版本可能存在兼容问题，执行以下命令升级：

yum update openssl

升级后重启应用，让Java重新加载系统加密库。

4. 更换JDK版本 #

部分定制版OpenJDK可能存在加密算法支持缺失，尝试切换至Oracle官方JDK 8u202或Adoptium Temurin 8等标准OpenJDK发行版。

5. 临时绕过EC套件 #

若以上方法无效，可暂时禁用EC相关Cipher套件，改用RSA系列套件：

String[] rsaOnlyCiphers = new String[]{
        "TLS_RSA_WITH_AES_128_GCM_SHA256",
        "TLS_RSA_WITH_AES_256_GCM_SHA384",
        "TLS_DHE_RSA_WITH_AES_128_GCM_SHA256"
};
// 在SSL配置中设置该套件数组

内容的提问来源于stack exchange，提问作者andy