Jetty v10中HTTPS端口8443无法启动应用，报Invalid SNI错误

问题现象 #

应用在Jetty v10环境下通过HTTPS端口8443启动后，客户端浏览器访问时出现异常，服务器端抛出以下堆栈跟踪：

oejs.HttpChannel:qtp2134607032-16: handleException /favicon.ico
org.eclipse.jetty.http.BadMessageException: 400: Invalid SNI
    at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:266)
    at org.eclipse.jetty.server.SecureRequestCustomizer.customize(SecureRequestCustomizer.java:207)
    at org.eclipse.jetty.server.HttpChannel.lambda$handle$0(HttpChannel.java:402)
    at org.eclipse.jetty.server.HttpChannel.dispatch(HttpChannel.java:663)
    at org.eclipse.jetty.server.HttpChannel.handle(HttpChannel.java:398)
    at org.eclipse.jetty.server.HttpConnection.onFillable(HttpConnection.java:282)
    at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:319)
    at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
    at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:538)
    at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:387)
    at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:161)
    at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:100)
    at org.eclipse.jetty.io.SocketChannelEndPoint$1.run(SocketChannelEndPoint.java:101)
    at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.runTask(AdaptiveExecutionStrategy.java:412)
    at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.consumeTask(AdaptiveExecutionStrategy.java:381)
    at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.tryProduce(AdaptiveExecutionStrategy.java:268)
    at org.eclipse.jetty.util.thread.strategy.AdaptiveExecutionStrategy.lambda$new$0(AdaptiveExecutionStrategy.java:138)
    at org.eclipse.jetty.util.thread.ReservedThreadExecutor$ReservedThread.run(ReservedThreadExecutor.java:378)
    at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:894)
    at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:1038)
    at java.base/java.lang.Thread.run(Thread.java:829)

已执行的操作步骤 #

openssl genrsa -des3 -out jcg.key
openssl req -new -x509 -key jcg.key -out jcg.crt
openssl pkcs12 -inkey jcg.key -in jcg.crt -export -out jcg.pkcs12
cp jcg.pkcs12 JETTY_BASE/etc/
jdk/bin/keytool -importkeystore -srckeystore jcg.pkcs12 -srcstoretype PKCS12 -destkeystore keystore

jdk/bin/java -cp $JETTY_BASE/lib/jetty-util-10.jar org.eclipse.jetty.util.security.Password <Your Password>

# 修改ssl.ini中的keystore、keymanage密码

解决方案 #

1. 重新生成包含SAN字段的自签名证书 #

Invalid SNI错误大多源于证书缺少**Subject Alternative Name（SAN）**字段，Jetty默认会验证SNI信息与证书匹配。重新生成证书时需指定SAN：

• 创建openssl配置文件san.cnf（根据实际需求修改域名/IP）：

  [req]
  distinguished_name = req_distinguished_name
  x509_extensions = v3_ca
  prompt = no
  
  [req_distinguished_name]
  CN = your-domain.com
  
  [v3_ca]
  subjectAltName = @alt_names
  
  [alt_names]
  DNS.1 = your-domain.com
  DNS.2 = localhost
  IP.1 = 127.0.0.1
  

• 用该配置生成证书：

  openssl req -new -x509 -key jcg.key -out jcg.crt -days 365 -config san.cnf
  

• 重新执行后续的PKCS12导出、keystore导入步骤，替换原有证书。

2. （测试环境可选）禁用Jetty的SNI强制验证 #

如果是本地测试场景，可临时禁用SNI验证绕过错误，生产环境不建议这么做：

在JETTY_BASE/etc/ssl.ini中添加或修改配置：

jetty.ssl.sniRequired=false

3. 验证keystore中的证书信息 #

确认证书已正确包含SAN字段：

keytool -list -v -keystore keystore -alias <your-cert-alias>

查看输出的Extension Attributes部分，确认存在Subject Alternative Name条目，且包含你访问时使用的域名/IP。

4. 确保访问地址与证书匹配 #

浏览器访问的域名/IP必须与证书的CN或SAN字段完全一致，否则会触发SNI验证失败。

内容的提问来源于stack exchange，提问作者Appu2506