Re: Unable to run TCPProxy with user defined Java keystore
Philip Aston <[email protected]>
| Newsgroups | gmane.comp.java.grinder.user |
|---|---|
| Message-ID | <[email protected]> |
OK - that's expected. See http://grinder.sourceforge.net/g3/tcpproxy.html#ssl Most users simply tell the browser to ignore the error, but it doesn't look like FF is presenting the option. I don't understand why the warning dialog is missing its "I understand the risks / Add exception" option. In the past, I'm sure I've also seen this missing. Anyone know why FF and Chrome have the "Add exception" option for some sites, but not others? - Phil On 13/05/14 15:29, alfinhaji . wrote: > Thanks for the response Phil. Maybe I should take it a step back. > When we turn on TCPProxy *_without_* using a keystore (using the > default Grinder certificates) this is the error we get back from the > browser (see screenshot attached). > > The error thrown in the CLI where TCPProxy is running is as follows: > > > 10:16:58.049 [Filter thread for > 127.0.0.1:55367->maps.qa.mycompany.ca:443 > <http://maps.qa.mycompany.ca:443>] ERROR: Received fatal alert: > bad_certificate > javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) ~[na:1.7.0_45] > at sun.security.ssl.AppInputStream.read(Unknown Source) > ~[na:1.7.0_45] > at > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > ~[grinder-http-3.11.jar:na] > at > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > [grinder-core-3.11.jar:na] > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > 10:19:49.527 [Filter thread for 127.0.0.1:55433->aus3.mozilla.org:443 > <http://aus3.mozilla.org:443>] ERROR: Received fatal alert: > bad_certificate > javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) ~[na:1.7.0_45] > at sun.security.ssl.AppInputStream.read(Unknown Source) > ~[na:1.7.0_45] > at > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > ~[grinder-http-3.11.jar:na] > at > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > [grinder-core-3.11.jar:na] > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > 10:21:49.446 [Filter thread for > 127.0.0.1:55474->easylist-downloads.adblockplus.org:443 > <http://easylist-downloads.adblockplus.org:443>] ERROR: Received fatal > alert: bad_certificate > javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > ~[na:1.7.0_45] > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) ~[na:1.7.0_45] > at sun.security.ssl.AppInputStream.read(Unknown Source) > ~[na:1.7.0_45] > > > On Tue, May 13, 2014 at 2:35 AM, Philip Aston <[email protected] > <mailto:[email protected]>> wrote: > > You seem to have a pretty clear trace there: > > "javax.net.ssl.SSLHandshakeException: no cipher suites in common " > > Your JDK and maps.qa.companyName.com > <http://maps.qa.companyName.com> do not have a common cipher suite. > > The Grinder enables all cipher suites available to the JDK. You may be > able to reconfigure maps.qa.companyName.com > <http://maps.qa.companyName.com> to support other cipher suites. > > - Phil > > On 09/05/14 19:40, alfinhaji wrote: > > We have hit an issue while attempting to take a recording with > TCPProxy for a > > new application we are testing. Using the default certs > (built-in) with > > TCPProxy, we are presenting with the warning dialog from the > browser. > > However, after adding the security exception we get a blank page > returned > > with the browser URL line in red with Certificate error > highlighted. When > > we turn off the proxy, we can hit this page fine and it renders > with no > > issue. > > > > So we went down the path of exporting the certificate for the > page from both > > IE and Firefox, using the keytool.exe utility to generate a > keystore, and > > then specifying this keystore before launching the TCPProxy. > Below are the > > steps we follow: > > > > 1. Exported the certificate as type X.509 Certificate (PEM) > (*.crt) in > > Firefox > > 2. Run the keytool.exe (JRE 1.7.0.45): > > "C:\Program Files\Java\jre7\bin\keytool.exe" -import -keystore > mapsKeystore > > -file appCert.crt -alias mapClient > > > > NOTE: We also tried these steps with JRE 1.6.0.45, same results. > > > > 3. When launching TCPProxy, we specify the above keystore: > > java -classpath %CLASSPATH% net.grinder.TCPProxy -keyStore > mapsKeystore > > -keyStorePassword ****** -console > > > > NOTE: We also looked at this article but didn't feel it was > applicable > > since we are a client, not a server, with a valid certificate > from the > > website exported from Firefox: > > > http://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html > > > > > > Following error is output to the console when launching TCPProxy and > > attempting to launch the page in a browser pointing to the Proxy > port: > > > > 14:52:41.987 [main] INFO : Initialising as an HTTP/HTTPS proxy > with the > > parameters: > > Request filters: EchoFilter > > Response filters: EchoFilter > > Local address: localhost:8001 > > Key store: C:\Development\Scripts\certs\mapsKeystore > > Key store password: ****** > > 14:52:42.540 [main] INFO : Engine initialised, listening on port > 8001 > > 14:53:02.721 [Filter thread for > > 127.0.0.1:60610->maps.qa.companyName.com:443 > <http://maps.qa.companyName.com:443>] ERROR: no cipher suites in > > common > > javax.net.ssl.SSLHandshakeException: no cipher suites in common > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.chooseCipherSuite(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.ServerHandshaker.clientHello(Unknown > Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.processMessage(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.processLoop(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.process_record(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.AppInputStream.read(Unknown Source) > > ~[na:1.7.0_45] > > at > > > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > > ~[grinder-http-3.11.jar:na] > > at > > > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > > [grinder-core-3.11.jar:na] > > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > > 14:53:02.750 [Filter thread for > > 127.0.0.1:60613->maps.qa.companyName.com:443 > <http://maps.qa.companyName.com:443>] ERROR: no cipher suites in > > common > > javax.net.ssl.SSLHandshakeException: no cipher suites in common > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.chooseCipherSuite(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.ServerHandshaker.clientHello(Unknown > Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.processMessage(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.processLoop(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.process_record(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.AppInputStream.read(Unknown Source) > > ~[na:1.7.0_45] > > at > > > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > > ~[grinder-http-3.11.jar:na] > > at > > > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > > [grinder-core-3.11.jar:na] > > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > > 14:53:02.801 [Filter thread for > > 127.0.0.1:60616->maps.qa.companyName.com:443 > <http://maps.qa.companyName.com:443>] ERROR: no cipher suites in > > common > > javax.net.ssl.SSLHandshakeException: no cipher suites in common > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.chooseCipherSuite(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.ServerHandshaker.clientHello(Unknown > Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.processMessage(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.processLoop(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.process_record(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.AppInputStream.read(Unknown Source) > > ~[na:1.7.0_45] > > at > > > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > > ~[grinder-http-3.11.jar:na] > > at > > > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > > [grinder-core-3.11.jar:na] > > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > > 14:53:02.842 [Filter thread for > > 127.0.0.1:60619->maps.qa.companyName.com:443 > <http://maps.qa.companyName.com:443>] ERROR: Remote host closed > > connection during handshake > > javax.net.ssl.SSLHandshakeException: Remote host closed > connection during > > handshake > > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.AppInputStream.read(Unknown Source) > > ~[na:1.7.0_45] > > at > > > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > > ~[grinder-http-3.11.jar:na] > > at > > > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > > [grinder-core-3.11.jar:na] > > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > > Caused by: java.io.EOFException: SSL peer shut down incorrectly > > at sun.security.ssl.InputRecord.read(Unknown Source) > ~[na:1.7.0_45] > > ... 7 common frames omitted > > 14:53:02.947 [Filter thread for > > 127.0.0.1:60622->maps.qa.companyName.com:443 > <http://maps.qa.companyName.com:443>] ERROR: no cipher suites in > > common > > javax.net.ssl.SSLHandshakeException: no cipher suites in common > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.chooseCipherSuite(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.ServerHandshaker.clientHello(Unknown > Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.processMessage(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.processLoop(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.process_record(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.AppInputStream.read(Unknown Source) > > ~[na:1.7.0_45] > > at > > > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > > ~[grinder-http-3.11.jar:na] > > at > > > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > > [grinder-core-3.11.jar:na] > > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > > 14:53:02.977 [Filter thread for > > 127.0.0.1:60625->maps.qa.companyName.com:443 > <http://maps.qa.companyName.com:443>] ERROR: no cipher suites in > > common > > javax.net.ssl.SSLHandshakeException: no cipher suites in common > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.chooseCipherSuite(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.ServerHandshaker.clientHello(Unknown > Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.processMessage(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.processLoop(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.process_record(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.AppInputStream.read(Unknown Source) > > ~[na:1.7.0_45] > > at > > > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > > ~[grinder-http-3.11.jar:na] > > at > > > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > > [grinder-core-3.11.jar:na] > > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > > 14:53:03.003 [Filter thread for > > 127.0.0.1:60628->maps.qa.companyName.com:443 > <http://maps.qa.companyName.com:443>] ERROR: no cipher suites in > > common > > javax.net.ssl.SSLHandshakeException: no cipher suites in common > > at sun.security.ssl.Alerts.getSSLException(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.fatalSE(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.chooseCipherSuite(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.ServerHandshaker.clientHello(Unknown > Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.ServerHandshaker.processMessage(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.processLoop(Unknown Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.Handshaker.process_record(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.AppInputStream.read(Unknown Source) > > ~[na:1.7.0_45] > > at > > > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > > ~[grinder-http-3.11.jar:na] > > at > > > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > > [grinder-core-3.11.jar:na] > > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > > 14:53:03.021 [Filter thread for > > 127.0.0.1:60631->maps.qa.companyName.com:443 > <http://maps.qa.companyName.com:443>] ERROR: Remote host closed > > connection during handshake > > javax.net.ssl.SSLHandshakeException: Remote host closed > connection during > > handshake > > at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source) > > ~[na:1.7.0_45] > > at > sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown > > Source) ~[na:1.7.0_45] > > at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown > Source) > > ~[na:1.7.0_45] > > at sun.security.ssl.AppInputStream.read(Unknown Source) > > ~[na:1.7.0_45] > > at > > > net.grinder.tools.tcpproxy.AbstractTCPProxyEngine$FilteredStreamThread.interruptibleRun(AbstractTCPProxyEngine.java:431) > > ~[grinder-http-3.11.jar:na] > > at > > > net.grinder.util.thread.InterruptibleRunnableAdapter.run(InterruptibleRunnableAdapter.java:58) > > [grinder-core-3.11.jar:na] > > at java.lang.Thread.run(Unknown Source) [na:1.7.0_45] > > Caused by: java.io.EOFException: SSL peer shut down incorrectly > > at sun.security.ssl.InputRecord.read(Unknown Source) > ~[na:1.7.0_45] > > ... 7 common frames omitted > > > > > > > > > ------------------------------------------------------------------------------ "Accelerate Dev Cycles with Automated Cross-Browser Testing - For FREE Instantly run your Selenium tests across 300+ browser/OS combos. Get unparalleled scalability from the best Selenium testing platform available Simple to use. Nothing to install. Get started now for free." http://p.sf.net/sfu/SauceLabs _______________________________________________ grinder-use mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/grinder-use