JDK-4470673 : JDK 1.4 Https cannot connect to Lotus Notes web server
  • Type: Bug
  • Component: security-libs
  • Sub-Component: javax.net.ssl
  • Affected Version: 1.4.0
  • Priority: P3
  • Status: Closed
  • Resolution: Duplicate
  • OS: linux
  • CPU: x86
  • Submitted: 2001-06-15
  • Updated: 2001-06-28
  • Resolved: 2001-06-28
Related Reports
Duplicate :  
Description

Name: bsC130419			Date: 06/15/2001


java version "1.4.0-beta"
Java(TM) 2 Runtime Environment, Standard Edition (build 1.4.0-beta-b65)
Java HotSpot(TM) Client VM (build 1.4.0-beta-b65, mixed mode)


1. Steps:
a. Connect to https://<some-lotus-server>. It fails with a "java.net.SocketException: Socket
closed" exception.
b. Connect to https://<some-other-server> . It succeeds
c. Using a browser (such as konqueror, or netscape) to connect https://<some-lotus-server>
succeeds.

d. Set up a server using the openssl, and the following command line:
     openssl s_server -cert server.crt -key ../ssl.key/server.key
   ===> java Https https://localhost:4433/ succeeds

e. openssl s_server -cert server.crt -key ../ssl.key/server.key -ssl2
   ===> It fails with "javax.net.ssl.SSLException: SSL V2.0 servers are not supported"

f. openssl s_server -cert server.crt -key ../ssl.key/server.key -ssl3
   ===> It fails with "java.net.SocketException: Socket closed" (i.e. same exception as with
  Lotus Notes). Openssl itself logs the following message:
8965:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:290:
shutting down SSL

g. openssl s_server -cert server.crt -key ../ssl.key/server.key -tls1
  ===> Same as f

h. openssl s_server -cert server.crt -key ../ssl.key/server.key -no_tls1
  ===> java Https fails with "java.io.IOException: Broken pipe", and openssl itself fails with
  9137:error:1408B074:SSL routines:SSL3_GET_CLIENT_KEY_EXCHANGE:bad protocol
version number:s3_srvr.c:1345:

N.B. connecting to servers d - h using a Web browser (such as konqueror) works all right.

====================================================================
2. Source code:

import java.net.URL;
import java.io.InputStream;
import java.io.FileInputStream;
import java.io.IOException;


public class Https {
  public static void main(String args[]) throws Exception {

    try {
      URL url;
      InputStream in;
      int c;
      for(int i=0; i<args.length; i++) {
    	url = new URL(args[i]);
    	in = url.openStream();
	System.out.println("begin");
    	while ( (c = in.read() ) != -1) {
	  System.out.write(c);
    	}
	System.out.println("end");
      }
    } catch(Exception e) {
      e.printStackTrace();
    }
  }
}

====================================================================
3/4: Exact text/trace of message:

java.net.SocketException: Socket closed
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a([DashoPro-V1.2-120198])         at
com.sun.net.ssl.internal.ssl.AppOutputStream.write([DashoPro-V1.2-120198])
        at java.io.OutputStream.write(OutputStream.java:61)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake([DashoPro-V1.2-120198])
        at
com.sun.net.ssl.internal.www.protocol.https.HttpsClient.doConnect([DashoPro-V1.2-120198])
        at
com.sun.net.ssl.internal.www.protocol.https.NetworkClient.openServer([DashoPro-V1.2-120198])
        at com.sun.net.ssl.internal.www.protocol.https.HttpClient.d([DashoPro-V1.2-120198])
        at
com.sun.net.ssl.internal.www.protocol.https.HttpClient.<init>([DashoPro-V1.2-120198])
        at
com.sun.net.ssl.internal.www.protocol.https.HttpsClient.<init>([DashoPro-V1.2-120198])
        at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120198])
        at com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120198])
        at
com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.connect([DashoPro-V1.2-120198])
        at
com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.getInputStream([DashoPro-V1.2-120198])
        at java.net.URL.openStream(URL.java:851)
        at Https.main(Https.java:20)
====================================================================
(Review ID: 126696) 
======================================================================

Comments
WORK AROUND Name: bsC130419 Date: 06/15/2001 It is possible to set up an openssl gateway which receives the SSL connection and forwards it to the Lotus Notes server. ======================================================================
02-09-2004

EVALUATION Probably related to the hello client problem we're addressing for merlin-beta2. bradford.wetmore@eng 2001-06-15 From the description and the error message at the server, it looks like the Lotus server does not support TLS v1 (3.1). Currently we always send TLSv1 as the version numbers in our client hello. In merlin we can use setEnabledProtocols(String[] protocols) to send either TLSv1 or SSLv3. I think that will solve the problem. Please see RFE 4416068. ram.marti@Eng 2001-06-28
28-06-2001