SSL Labs测试证书触发大量SSLHandshakeException，寻求解决方法

Hey there! Let's break down what's happening and how to fix this issue step by step.

The Root Cause #

Your custom web server is throwing SSLHandshakeException (triggered by EOFException) because it tries to read from an input stream that has no data. This happens when SSL Labs sends empty test requests or your load balancer runs health checks that don't send a full HTTP request. Unlike normal user traffic (which provides valid HTTP data), these empty connections cause an error when InputStreamReader attempts to read bytes that don't exist.

Step 1: Add Graceful Exception Handling #

First, you need to catch the specific exceptions from empty connections and handle them without crashing the response thread. Modify your run() method (or wherever you manage socket connections) to wrap stream reading and request parsing in a targeted try-catch block:

public void run() {
    // Keep your existing variable reset code here
    REQUEST = new HashMap();
    RESOURCE = "";
    QUERY_STRING = "";
    // ... (all other initialization variables)

    try {
        // BLOCK AND WAIT FOR A CONNECTION
        socket = w.getConnection();
        IP = socket.getInetAddress().getHostAddress();
        out = new BufferedOutputStream(socket.getOutputStream());
        isr = new InputStreamReader(socket.getInputStream(), w.CHARSET);
        
        parseRequest();
        // ... rest of your request processing logic
    } catch (EOFException | SSLHandshakeException e) {
        // Handle empty/aborted requests from SSL Labs or load balancers
        sendHealthCheckResponse();
    } catch (IOException e) {
        // Handle other IO-related errors
        e.printStackTrace();
        sendErrorResponse(500);
    } finally {
        // Always clean up resources to avoid leaks
        try {
            if (isr != null) isr.close();
            if (out != null) out.close();
            if (socket != null && !socket.isClosed()) socket.close();
        } catch (IOException cleanupEx) {
            cleanupEx.printStackTrace();
        }
    }
}

Step 2: Send a Valid HTTP Response for Empty Requests #

Both SSL Labs and load balancers only need confirmation that your server is reachable and responsive. The simplest valid response is a 200 OK with no body. Implement this helper method:

private void sendHealthCheckResponse() throws IOException {
    // Follow HTTP 1.1 standards: use \r\n line endings and a blank line after headers
    String response = "HTTP/1.1 200 OK\r\n" +
                      "Content-Length: 0\r\n" +
                      "Connection: close\r\n" +
                      "\r\n"; // Blank line separates headers from body
    out.write(response.getBytes(w.CHARSET));
    out.flush();
}

If your load balancer expects a more explicit response (like a simple "OK" body), adjust the method like this:

private void sendHealthCheckResponse() throws IOException {
    String body = "OK";
    String response = "HTTP/1.1 200 OK\r\n" +
                      "Content-Length: " + body.length() + "\r\n" +
                      "Connection: close\r\n" +
                      "\r\n" +
                      body;
    out.write(response.getBytes(w.CHARSET));
    out.flush();
}

Why Your Previous Fix Didn't Work #

The -Dhttps.protocols parameter addresses TLS version compatibility, but your issue isn't related to protocol support—it's about how your server handles incomplete or empty requests. That's why adjusting protocols didn't resolve the exception.

Bonus: Prevent Exceptions Upfront #

For extra robustness, check if the input stream has data available before attempting to parse it. Add this right after initializing isr:

// Exit early if no data is available (empty request)
if (socket.getInputStream().available() == 0) {
    sendHealthCheckResponse();
    return;
}

This avoids triggering the exception entirely by detecting empty streams before parsing.

内容的提问来源于stack exchange，提问作者Elton