S3上传文件报Unsupported or unrecognized SSL message异常咨询

DevOps 小满

2026-8-29

问题现象

尝试向S3存储保存文件时抛出如下异常：

Caused by: com.amazonaws.SdkClientException: Unable to execute HTTP request: Unsupported or unrecognized SSL message
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.handleRetryableException(AmazonHttpClient.java:1216) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeHelper(AmazonHttpClient.java:1162) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.doExecute(AmazonHttpClient.java:811) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.executeWithTimer(AmazonHttpClient.java:779) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.execute(AmazonHttpClient.java:753) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutor.access$500(AmazonHttpClient.java:713) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.http.AmazonHttpClient$RequestExecutionBuilderImpl.execute(AmazonHttpClient.java:695) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:559) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.http.AmazonHttpClient.execute(AmazonHttpClient.java:539) ~[aws-java-sdk-core-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:5437) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client.getBucketRegionViaHeadRequest(AmazonS3Client.java:6408) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client.fetchRegionFromCache(AmazonS3Client.java:6381) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:5422) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client.invoke(AmazonS3Client.java:5384) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client.access$300(AmazonS3Client.java:421) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client$PutObjectStrategy.invokeServiceCall(AmazonS3Client.java:6508) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client.uploadObject(AmazonS3Client.java:1856) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at com.amazonaws.services.s3.AmazonS3Client.putObject(AmazonS3Client.java:1816) ~[aws-java-sdk-s3-1.12.37.jar:?]
    at 
    ... 138 more
Caused by: javax.net.ssl.SSLException: Unsupported or unrecognized SSL message
    at sun.security.ssl.SSLSocketInputRecord.handleUnknownRecord(SSLSocketInputRecord.java:451) ~[?:?]
    at sun.security.ssl.SSLSocketInputRecord.decode(SSLSocketInputRecord.java:175) ~[?:?]
    at sun.security.ssl.SSLTransport.decode(SSLTransport.java:111) ~[?:?]
    at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1506) ~[?:?]
    at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1416) ~[?:?]
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:456) ~[?:?]
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:427) ~[?:?]
    at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:394) ~[httpclient-4.5.2.jar:4.5.2]

现有S3客户端配置代码

ClientConfiguration config = new ClientConfiguration();
config.setSocketTimeout(SOCKET_TIMEOUT_IN_SECONDS * 1000);
config.setRetryPolicy(new RetryPolicy(null, RetryPolicy.BackoffStrategy.NO_DELAY, 3, false));

AmazonS3ClientBuilder builder = AmazonS3ClientBuilder.standard().withClientConfiguration(config)
        .withCredentials(getAWSCredentialsProvider())
        .enableForceGlobalBucketAccess();
        .withRegion(Regions.US_EAST_1);

client = builder.build();

问题根因定位

异常核心原因是客户端发起HTTPS握手时，收到的对端响应不是合法的SSL协议报文，属于配置/环境连通性问题，和上传逻辑本身无关。
首先注意你贴的代码存在一个语法笔误：.enableForceGlobalBucketAccess(); 行尾多了分号，会打断链式调用直接导致编译失败，如果是贴代码时手滑可忽略，否则先修正该语法错误。

排除语法问题后，常见触发场景按概率从高到低排序：

端点配置错误：如果你用的不是AWS官方S3，是MinIO、Ceph RGW这类自建S3兼容存储，没有显式配置自定义endpoint，SDK会默认拼接AWS官方S3域名，请求被网络防火墙/网关转发到非HTTPS端口时，会收到明文HTTP响应，SSL解析直接失败。
网络代理配置异常：服务运行环境配置了HTTP代理，但代理不支持HTTPS CONNECT隧道透传，直接给客户端返回明文HTTP错误响应，触发SSL报错。
协议不匹配：你连接的S3服务仅支持HTTP协议，但客户端默认使用HTTPS发起请求，HTTP明文响应无法被SSL协议解析。
JDK信任库问题概率极低，这类问题通常会抛出PKIX path building failed类的证书校验错误，和当前异常特征不符。

排查&修复方案

第一步先修正代码语法错误，删除.enableForceGlobalBucketAccess()行尾多余的分号，保证代码可正常编译运行。
第二步确认S3服务类型：
- 如果是自建S3兼容服务，必须显式配置自定义端点，不要仅指定区域：
```
// 替换为实际的S3服务地址和对应区域
builder.withEndpointConfiguration(new AwsClientBuilder.EndpointConfiguration("http://你的S3服务地址", "对应区域"))
```
- 如果是AWS官方S3，先在服务部署机器执行curl -v https://s3.us-east-1.amazonaws.com测试连通性，确认SSL握手正常、能收到合法响应，如果curl也报SSL错误，优先排查网络链路、防火墙、出口代理配置。

第三步如果环境存在网络代理，在ClientConfiguration中显式配置代理参数，确认代理支持HTTPS透传：

// 替换为实际代理信息
config.setProxyHost("代理地址");
config.setProxyPort(代理端口);
// 代理无认证可省略以下两行
config.setProxyUsername("代理用户名");
config.setProxyPassword("代理密码");

第四步如果你的S3服务确实仅支持HTTP协议，可在配置中指定使用HTTP协议（生产环境不推荐，会导致数据明文传输）：
```
config.setProtocol(Protocol.HTTP);
```

内容的提问来源于stack exchange，提问作者Yosefarr