JDK 1.8.0_162下HTTPS握手报TlsPremasterSecret密钥工厂缺失解决咨询

Hey there, let's tackle this SSL handshake issue you're facing! That error in DHCrypt.getAgreedSecret almost always ties to mismatched DH (Diffie-Hellman) key exchange configurations between your JDK 1.8.0_162 and the target server. Since other URLs work fine, the problem is definitely specific to that server's HTTPS setup. Here's how to add the right SecretKeyFactory or adjust your security settings to resolve it:

Step 1: Identify the Server's DH Configuration First #

Before jumping into fixes, you need to know exactly what DH parameters the target server uses. Run this openssl command to inspect its SSL setup:

openssl s_client -connect your-target-domain:443

Look for lines related to DH (like Server Temp Key: DH, 2048 bits or the cipher suite being used, e.g., TLS_DHE_RSA_WITH_AES_256_CBC_SHA). This tells you which algorithm/key length you need to support.

Step 2: Add a Custom SecretKeyFactory (or Use a Third-Party Provider) #

JDK 1.8.0_162 might lack support for the server's specific DH-derived key algorithm. The easiest way to add this is by using a robust security provider like BouncyCastle, which includes a wider range of SecretKeyFactory implementations.

Option A: Register BouncyCastle Dynamically in Code #

1. Add the BouncyCastle dependency to your project (e.g., via Maven or Gradle).
2. Register the provider before initializing your SSL context:

   import org.bouncycastle.jce.provider.BouncyCastleProvider;
   import java.security.Security;
   
   // Do this early in your application startup
   if (Security.getProvider("BC") == null) {
       Security.addProvider(new BouncyCastleProvider());
   }
   

Option B: Register BouncyCastle Globally in JDK #

If you want the provider available to all applications using this JDK:

1. Download the BouncyCastle JAR (e.g., bcprov-jdk15on-1.70.jar) and place it in <JDK_HOME>/jre/lib/ext.
2. Open <JDK_HOME>/jre/lib/security/java.security and add this line to the provider list (adjust the number to fit the sequence):

   security.provider.11=org.bouncycastle.jce.provider.BouncyCastleProvider
   

Step 3: Adjust JDK DH Security Settings #

Sometimes the issue isn't missing algorithms, but default restrictions in JDK 1.8.0_162:

• Increase Ephemeral DH Key Size: The JDK might enforce a minimum key size that's lower than the server's. Edit java.security and set:

  jdk.tls.ephemeralDHKeySize=2048
  

  Match the key size you found in Step 1.
• Specify Compatible Cipher Suites: Force your connection to use only cipher suites the server supports. For example:

  import javax.net.ssl.HttpsURLConnection;
  import javax.net.ssl.SSLContext;
  import javax.net.ssl.SSLSocketFactory;
  import java.io.IOException;
  import java.net.URL;
  
  public class SSLFixExample {
      public static void main(String[] args) throws IOException {
          try {
              SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
              sslContext.init(null, null, null);
              SSLSocketFactory originalFactory = sslContext.getSocketFactory();
  
              // Wrap the factory to enforce specific cipher suites
              SSLSocketFactory customFactory = new SSLSocketFactory() {
                  @Override
                  public String[] getDefaultCipherSuites() {
                      return new String[]{"TLS_DHE_RSA_WITH_AES_256_GCM_SHA384"}; // Use the suite from Step 1
                  }
  
                  @Override
                  public String[] getSupportedCipherSuites() {
                      return getDefaultCipherSuites();
                  }
  
                  // Delegate all other methods to the original factory
                  @Override
                  public java.net.Socket createSocket(java.net.Socket s, String host, int port, boolean autoClose) throws IOException {
                      java.net.Socket socket = originalFactory.createSocket(s, host, port, autoClose);
                      ((javax.net.ssl.SSLSocket)socket).setEnabledCipherSuites(getDefaultCipherSuites());
                      return socket;
                  }
  
                  @Override
                  public java.net.Socket createSocket(String host, int port) throws IOException {
                      java.net.Socket socket = originalFactory.createSocket(host, port);
                      ((javax.net.ssl.SSLSocket)socket).setEnabledCipherSuites(getDefaultCipherSuites());
                      return socket;
                  }
  
                  @Override
                  public java.net.Socket createSocket(String host, int port, java.net.InetAddress localHost, int localPort) throws IOException {
                      java.net.Socket socket = originalFactory.createSocket(host, port, localHost, localPort);
                      ((javax.net.ssl.SSLSocket)socket).setEnabledCipherSuites(getDefaultCipherSuites());
                      return socket;
                  }
  
                  @Override
                  public java.net.Socket createSocket(java.net.InetAddress host, int port) throws IOException {
                      java.net.Socket socket = originalFactory.createSocket(host, port);
                      ((javax.net.ssl.SSLSocket)socket).setEnabledCipherSuites(getDefaultCipherSuites());
                      return socket;
                  }
  
                  @Override
                  public java.net.Socket createSocket(java.net.InetAddress address, int port, java.net.InetAddress localAddress, int localPort) throws IOException {
                      java.net.Socket socket = originalFactory.createSocket(address, port, localAddress, localPort);
                      ((javax.net.ssl.SSLSocket)socket).setEnabledCipherSuites(getDefaultCipherSuites());
                      return socket;
                  }
              };
  
              HttpsURLConnection connection = (HttpsURLConnection) new URL("your-target-url").openConnection();
              connection.setSSLSocketFactory(customFactory);
              // Proceed with connection...
          } catch (Exception e) {
              e.printStackTrace();
          }
      }
  }
  

Step 4: Verify the Fix #

After making these changes, re-run your connection to the target URL. If the handshake still fails, use a tool like Wireshark to capture the SSL handshake traffic—this will show exactly which step is failing (e.g., server rejecting your cipher suite) so you can tweak your configuration further.

内容的提问来源于stack exchange，提问作者Martin Müller