Skip to content

Instantly share code, notes, and snippets.

@YutaHiguchi-bsn
Created June 4, 2019 23:25
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save YutaHiguchi-bsn/c76dfd60ac4c2c711fcaddbf6b267f3b to your computer and use it in GitHub Desktop.
Save YutaHiguchi-bsn/c76dfd60ac4c2c711fcaddbf6b267f3b to your computer and use it in GitHub Desktop.
EOFException on certificate error
import static org.hamcrest.Matchers.instanceOf;
import static org.hamcrest.Matchers.not;
import static org.junit.Assert.assertThat;
import java.io.EOFException;
import java.util.concurrent.CountDownLatch;
import java.util.concurrent.atomic.AtomicReference;
import org.eclipse.jetty.client.HttpClient;
import org.eclipse.jetty.http.HttpMethod;
import org.eclipse.jetty.util.ssl.SslContextFactory;
import org.junit.Test;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
public class Minimum {
private static final Logger logger = LoggerFactory.getLogger(Minimum.class);
@Test
public void sslErrorHidden() throws Exception {
SslContextFactory.Client sslContextFactory = new SslContextFactory.Client(false);
HttpClient jetty;
jetty = new HttpClient(sslContextFactory);
jetty.start();
String someSelfSignedHttpsServer = "https://....";
CountDownLatch latch = new CountDownLatch(1);
AtomicReference<Throwable> error = new AtomicReference<>();
jetty.newRequest(someSelfSignedHttpsServer)
.method(HttpMethod.POST)
.send(result -> {
if (result.isFailed()) {
logger.error("send: ", result.getFailure());
error.set(result.getFailure());
}
latch.countDown();
});
latch.await();
assertThat(error.get(), not(instanceOf(EOFException.class)));
}
}
@YutaHiguchi-bsn
Copy link
Author

Running above result in following log from listener registered at send(..)
Failure retrieved at listener is an EOFException and it's not possible to determine if the error was certificate error or not.

16:20:12.916 ERROR [o.p.d.r.c.j.Minimum:HttpClient@3b088d51-21] send: 
java.io.EOFException: HttpConnectionOverHTTP@64bd5e52::DecryptedEndPoint@3e123d1{/10.2.0.21:8443<->/10.100.12.53:55896,CLOSED,fill=-,flush=C,to=9/0}
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.earlyEOF(HttpReceiverOverHTTP.java:338)
	at org.eclipse.jetty.http.HttpParser.parseNext(HttpParser.java:1551)
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.shutdown(HttpReceiverOverHTTP.java:209)
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.process(HttpReceiverOverHTTP.java:147)
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.receive(HttpReceiverOverHTTP.java:73)
	at org.eclipse.jetty.client.http.HttpChannelOverHTTP.receive(HttpChannelOverHTTP.java:133)
	at org.eclipse.jetty.client.http.HttpConnectionOverHTTP.onFillable(HttpConnectionOverHTTP.java:155)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
	at org.eclipse.jetty.io.ssl.SslConnection$1.run(SslConnection.java:144)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:698)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:804)
	at java.lang.Thread.run(Thread.java:748)

If I increase the log level of org.eclipse.jetty.io to DEBUG, I see log about SSLHandshakeException.
Is there a way to retrieve them from the client?

16:20:12.911 DEBUG [o.e.j.i.s.SslConnection:HttpClient@3b088d51-20] SslConnection@7aea0c11::SocketChannelEndPoint@1cfb439a{/10.2.0.21:8443<->/10.100.12.53:55896,OPEN,fill=-,flush=-,to=31/0}{io=0/0,kio=0,kro=1}->SslConnection@7aea0c11{NEED_WRAP,eio=475/-1,di=-1,fill=IDLE,flush=IDLE}~>DecryptedEndPoint@3e123d1{/10.2.0.21:8443<->/10.100.12.53:55896,OPEN,fill=FI,flush=C,to=2/0}=>HttpConnectionOverHTTP@64bd5e52(l:/10.100.12.53:55896 <-> r:/10.2.0.21:8443,closed=false)=>HttpChannelOverHTTP@229c26cc(exchange=HttpExchange@1d15ce82 req=PENDING/null@null res=PENDING/null@null)[send=HttpSenderOverHTTP@83c3c0a(req=HEADERS,snd=SENDING,failure=null)[HttpGenerator@2c97977{s=COMPLETING}],recv=HttpReceiverOverHTTP@c08e8b2(rsp=IDLE,failure=null)[HttpParser{s=START,0 of -1}]]
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
	at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1521)
	at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:528)
	at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1197)
	at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1165)
	at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:509)
	at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.flush(SslConnection.java:890)
	at org.eclipse.jetty.io.WriteFlusher.flush(WriteFlusher.java:393)
	at org.eclipse.jetty.io.WriteFlusher.completeWrite(WriteFlusher.java:349)
	at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.lambda$fill$1(SslConnection.java:670)
	at org.eclipse.jetty.util.thread.QueuedThreadPool.runJob(QueuedThreadPool.java:698)
	at org.eclipse.jetty.util.thread.QueuedThreadPool$Runner.run(QueuedThreadPool.java:804)
	at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
	at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
	at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1709)
	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:318)
	at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:310)
	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1639)
	at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:223)
	at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037)
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:970)
	at sun.security.ssl.Handshaker$1.run(Handshaker.java:967)
	at java.security.AccessController.doPrivileged(Native Method)
	at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459)
	at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.fill(SslConnection.java:527)
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.process(HttpReceiverOverHTTP.java:128)
	at org.eclipse.jetty.client.http.HttpReceiverOverHTTP.receive(HttpReceiverOverHTTP.java:73)
	at org.eclipse.jetty.client.http.HttpChannelOverHTTP.receive(HttpChannelOverHTTP.java:133)
	at org.eclipse.jetty.client.http.HttpConnectionOverHTTP.onFillable(HttpConnectionOverHTTP.java:155)
	at org.eclipse.jetty.io.AbstractConnection$ReadCallback.succeeded(AbstractConnection.java:305)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
	at org.eclipse.jetty.io.ssl.SslConnection$DecryptedEndPoint.onFillable(SslConnection.java:427)
	at org.eclipse.jetty.io.ssl.SslConnection.onFillable(SslConnection.java:321)
	at org.eclipse.jetty.io.ssl.SslConnection$2.succeeded(SslConnection.java:159)
	at org.eclipse.jetty.io.FillInterest.fillable(FillInterest.java:103)
	at org.eclipse.jetty.io.ChannelEndPoint$2.run(ChannelEndPoint.java:117)
	... 3 common frames omitted
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:397)
	at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:302)
	at sun.security.validator.Validator.validate(Validator.java:262)
	at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
	at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:281)
	at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:136)
	at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1626)
	... 21 common frames omitted
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141)
	at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126)
	at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
	at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:392)
	... 27 common frames omitted

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment