Develop Reference

BouncyCastleJsseProvider: Client raised fatal(2) internal_error(80) alert: Failed to read record

I have run into an issue developing a HTTP client with the use of BouncyCastle libraries.
Target versions (but the error is also reproducible in Java 1.8.0_91 with the same version of BouncyCastle.)
JRE 1.6.0_45-b06
BouncyCastle jdk15to18 167 (bcprov-jdk15to18-167.jar, bcpkix-jdk15to18-167.jar, bctls-jdk15to18-167.jar)
HTTPClient code:
String strURL = "https://www.<WEBSITE>.com";
// CODE to set default TrustStore, KeyStore to be used
// setup BC as SecurityProvider and SSLSocketFactoryProvider
/*
Security.insertProviderAt(new BouncyCastleProvider(), 1);
Security.insertProviderAt(new BouncyCastleJsseProvider(), 2);
Security.setProperty("ssl.KeyManagerFactory.algorithm", "PKIX");
Security.setProperty("ssl.TrustManagerFactory.algorithm", "PKIX");
Security.setProperty("ssl.SocketFactory.provider", "org.bouncycastle.jsse.provider.SSLSocketFactoryImpl");
System.setProperty("jdk.tls.trustNameService", "true");
*/
URL url = new URL( strURL );
HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setDoOutput(true);
conn.setRequestMethod("GET");
InputStream is = null;
if (conn.getResponseCode() == HttpURLConnection.HTTP_OK) {
System.out.println("OK");
is = conn.getInputStream();
} else if (conn.getResponseCode() == HttpURLConnection.HTTP_INTERNAL_ERROR) {
System.out.println("ERROR");
is = conn.getErrorStream();
} else {
System.out.println( conn.getResponseCode() );
System.out.println( conn.getResponseMessage() );
}
if (is != null) {
System.out.println( readFullyAsString(is, "UTF-8") );
}
conn.disconnect();
Accessing data on a website with TLS 1.2 without client_auth works fine (there are some issues with specific sites that return handshake_failure(40), but luckily not in our case). But when client_auth is required the code fails with the following (a little cryptic) error:
nov. 27, 2020 5:23:10 PM org.bouncycastle.jsse.provider.ProvTlsClient notifyAlertRaised
WARNING: Client raised fatal(2) internal_error(80) alert: Failed to read record
java.net.SocketException: Connection reset
at java.net.SocketInputStream.read(Unknown Source)
at java.net.SocketInputStream.read(Unknown Source)
at org.bouncycastle.tls.RecordStream$Record.fillTo(RecordStream.java:429)
at org.bouncycastle.tls.RecordStream$Record.readHeader(RecordStream.java:468)
at org.bouncycastle.tls.RecordStream.readRecord(RecordStream.java:201)
at org.bouncycastle.tls.TlsProtocol.safeReadRecord(TlsProtocol.java:768)
at org.bouncycastle.tls.TlsProtocol.readApplicationData(TlsProtocol.java:731)
at org.bouncycastle.jsse.provider.ProvSSLSocketDirect$AppDataInput.read(ProvSSLSocketDirect.java:603)
at java.io.BufferedInputStream.fill(Unknown Source)
at java.io.BufferedInputStream.read1(Unknown Source)
at java.io.BufferedInputStream.read(Unknown Source)
at sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
at HttpsClient.main(HttpsClient.java:109)
nov. 27, 2020 5:23:10 PM org.bouncycastle.jsse.provider.ProvTlsClient notifyAlertRaised
WARNING: Client raised fatal(2) internal_error(80) alert: Failed to read record
java.net.SocketException: Connection reset
at java.net.SocketInputStream.read(Unknown Source)
at java.net.SocketInputStream.read(Unknown Source)
at org.bouncycastle.tls.RecordStream$Record.fillTo(RecordStream.java:429)
at org.bouncycastle.tls.RecordStream$Record.readHeader(RecordStream.java:468)
at org.bouncycastle.tls.RecordStream.readRecord(RecordStream.java:201)
at org.bouncycastle.tls.TlsProtocol.safeReadRecord(TlsProtocol.java:768)
at org.bouncycastle.tls.TlsProtocol.readApplicationData(TlsProtocol.java:731)
at org.bouncycastle.jsse.provider.ProvSSLSocketDirect$AppDataInput.read(ProvSSLSocketDirect.java:603)
at java.io.BufferedInputStream.fill(Unknown Source)
at java.io.BufferedInputStream.read1(Unknown Source)
at java.io.BufferedInputStream.read(Unknown Source)
at sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
at HttpsClient.main(HttpsClient.java:109)
java.net.SocketException: Connection reset
at java.net.SocketInputStream.read(Unknown Source)
at java.net.SocketInputStream.read(Unknown Source)
at org.bouncycastle.tls.RecordStream$Record.fillTo(RecordStream.java:429)
at org.bouncycastle.tls.RecordStream$Record.readHeader(RecordStream.java:468)
at org.bouncycastle.tls.RecordStream.readRecord(RecordStream.java:201)
at org.bouncycastle.tls.TlsProtocol.safeReadRecord(TlsProtocol.java:768)
at org.bouncycastle.tls.TlsProtocol.readApplicationData(TlsProtocol.java:731)
at org.bouncycastle.jsse.provider.ProvSSLSocketDirect$AppDataInput.read(ProvSSLSocketDirect.java:603)
at java.io.BufferedInputStream.fill(Unknown Source)
at java.io.BufferedInputStream.read1(Unknown Source)
at java.io.BufferedInputStream.read(Unknown Source)
at sun.net.www.http.HttpClient.parseHTTPHeader(Unknown Source)
at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
at sun.net.www.http.HttpClient.parseHTTP(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
at java.net.HttpURLConnection.getResponseCode(Unknown Source)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(Unknown Source)
at HttpsClient.main(HttpsClient.java:109)
As expected the code runs just fine in Java 1.8 without BC as Security Provider ... but in Java 1.6 BC is needed for TLS 1.2 support.
I looked at the packets with Wireshark, but I don't have enough knowledge to analyze what's happening (failing) with the SSL handshake operation with the server.
What am I missing here? Or it's just a known limitation of BC?
Thanks for any suggestions.

After extensive research and testing (we set up our own dev environment that replicated the endpoint, we were trying to connect to with client cert) we have found a solution (posted below) that works for us in our dev environment, but couldn't be configured on the endpoint. That's why we went to plan B - TLS termination proxy and it worked like a charm in our case, when we didn't have control of the server environment.
Solution for IIS
In our case the web service requiring client auth was running on Microsoft IIS. As stated "Unfortunately our TLS libraries do not support renegotiation (and we do not plan to add it, although there are corresponding TLS 1.3 features that we will)." in this open issue (https://github.com/bcgit/bc-java/issues/593). After reading the IIS documentation and some testing we successfully configured the environment in a way that TLS sessions could be established with BC TLS lib:
Step 1:
Create an IIS site with default settings
Run IISCrypto with the "Best practices" template:
Step 2:
Enable SSLAlwaysNegoClientCert
Save the following text to a file called "Enable_SSL_Renegotiate.js"
var vdirObj=GetObject("IIS://localhost/W3svc/1");
// replace 1 on this line with the number of the web site you wish to configure
WScript.Echo("Value of SSLAlwaysNegoClientCert Before: " + vdirObj.SSLAlwaysNegoClientCert);
vdirObj.Put("SSLAlwaysNegoClientCert", true);
vdirObj.SetInfo();
WScript.Echo("Value of SSLAlwaysNegoClientCert After: " + vdirObj.SSLAlwaysNegoClientCert);
Run the following command from an elevated / administrator command prompt:
cscript.exe enable_ssl_renegotiate.js
I posted the same answer on BouncyCastle Github - #847

Unable to obtain credentials to communicate with the Cloud SQL API, Remote host closed connection during handshake

I am trying to connect to mysql which is on google cloud using below code. This is my first attempt to work on google cloud sql using mysql.
public static void main(String[] args) throws IOException, SQLException {
String instanceConnectionName = "####";//providing correct connection name
String databaseName = "shan";
String username = "root";
String password = "####";//providing correct password
String jdbcUrl = String.format(
"jdbc:mysql://google/%s?cloudSqlInstance=%s&"
+ "socketFactory=com.google.cloud.sql.mysql.SocketFactory",
databaseName,
instanceConnectionName);
Connection connection = DriverManager.getConnection(jdbcUrl, username, password);
try (Statement statement = connection.createStatement()) {
ResultSet resultSet = statement.executeQuery("SHOW TABLES");
while (resultSet.next()) {
System.out.println(resultSet.getString(1));
}
}
}
When i try to execute this code, i am getting the below error:
Feb 25, 2018 4:45:41 PM com.google.cloud.sql.mysql.SocketFactory connect
INFO: Connecting to Cloud SQL instance [stockinventary-1517746804001:asia-east1:shan].
Feb 25, 2018 4:45:41 PM com.google.cloud.sql.core.SslSocketFactory getInstance
INFO: First Cloud SQL connection, generating RSA key pair.
Exception in thread "main" com.mysql.jdbc.exceptions.jdbc4.MySQLNonTransientConnectionException: Could not create connection to database server.
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:425)
at com.mysql.jdbc.Util.getInstance(Util.java:408)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:918)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:897)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:886)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:860)
at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2271)
at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2024)
at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:779)
at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:47)
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:425)
at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:389)
at com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:330)
at java.sql.DriverManager.getConnection(Unknown Source)
at java.sql.DriverManager.getConnection(Unknown Source)
at com.sf.si.poc.ListTables.main(ListTables.java:48)
Caused by: java.lang.RuntimeException: Unable to obtain credentials to communicate with the Cloud SQL API
at com.google.cloud.sql.core.SslSocketFactory$ApplicationDefaultCredentialFactory.create(SslSocketFactory.java:549)
at com.google.cloud.sql.core.SslSocketFactory.getInstance(SslSocketFactory.java:140)
at com.google.cloud.sql.mysql.SocketFactory.connect(SocketFactory.java:48)
at com.mysql.jdbc.MysqlIO.<init>(MysqlIO.java:300)
at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2192)
at com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2225)
... 13 more
Caused by: java.io.IOException: Error reading credential file from location C:\Users\dell\AppData\Roaming\gcloud\application_default_credentials.json: Remote host closed connection during handshake
at com.google.api.client.googleapis.auth.oauth2.DefaultCredentialProvider.getCredentialUsingWellKnownFile(DefaultCredentialProvider.java:251)
at com.google.api.client.googleapis.auth.oauth2.DefaultCredentialProvider.getDefaultCredentialUnsynchronized(DefaultCredentialProvider.java:117)
at com.google.api.client.googleapis.auth.oauth2.DefaultCredentialProvider.getDefaultCredential(DefaultCredentialProvider.java:91)
at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.getApplicationDefault(GoogleCredential.java:213)
at com.google.api.client.googleapis.auth.oauth2.GoogleCredential.getApplicationDefault(GoogleCredential.java:191)
at com.google.cloud.sql.core.SslSocketFactory$ApplicationDefaultCredentialFactory.create(SslSocketFactory.java:547)
... 18 more
I also ran gcloud sql instances describe and it generated json file at: C:\Users\dell\AppData\Roaming\gcloud\application_default_credentials.json
Could you please guide me to figure out the actual cause of this issue and way to correct it?

I got the answer with my own analysis and here it is:
I added GOOGLE_APPLICATION_CREDENTIALS environment variable with json file(which was created when i run gcloud auth application-default login) as value.
This resolved my problem.
Thanks.

com.mysql.jdbc.exceptions.jdbc4.MySQLNonTransientConnectionException: Failed to get a connection using the URL '192.168.1.133:3306'

I am just trying to run a simple unit test which requires database connection.
private static MysqlDataSource dataSource=new MysqlDataSource();
#BeforeEach
void setUpBefore() throws Exception {
dataSource.setURL("192.168.1.133:3306");
dataSource.setUser("user");
dataSource.setPassword("password");
}
and late in the actual unit test
map=new MenuDAO(dataSource.getConnection()).getMenu(); //throws exception
I do have MySQL Workbench successfully connect to MySQL database with the above settings. However when JUnit executes the test I get the following exception. Not sure why.
com.mysql.jdbc.exceptions.jdbc4.MySQLNonTransientConnectionException: Failed to get a connection using the URL '192.168.1.133:3306'.
at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)
at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Source)
at java.lang.reflect.Constructor.newInstance(Unknown Source)
at com.mysql.jdbc.Util.handleNewInstance(Util.java:425)
at com.mysql.jdbc.Util.getInstance(Util.java:408)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:918)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:897)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:886)
at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:860)
at com.mysql.jdbc.jdbc2.optional.MysqlDataSource.getConnection(MysqlDataSource.java:413)
at com.mysql.jdbc.jdbc2.optional.MysqlDataSource.getConnection(MysqlDataSource.java:136)
at com.mysql.jdbc.jdbc2.optional.MysqlDataSource.getConnection(MysqlDataSource.java:107)
at com.m2ii.MenuService.dao.test.MenuDAO_UT.testGetMenu(MenuDAO_UT.java:41)

The setURL method needs to have a little bit more. Make it jdbc:mysql://192.168.1.133:3306

Californium CoAP Server Error on addEndpoints

I am trying one of example CoAP server program from
https://github.com/eclipse/californium.core/tree/master/cf-helloworld-server/src/main/java/org/eclipse/californium/examples/HelloWorldServer.java
I have used library CoAP from http://mvnrepository.com/artifact/org.eclipse.californium/californium-core/1.0.1
When I run below code to addEndpoints, I get an exception:
private void addEndpoints() {
for (InetAddress addr : EndpointManager.getEndpointManager().getNetworkInterfaces()) {
// only binds to IPv4 addresses and localhost
if (addr instanceof Inet4Address || addr.isLoopbackAddress()) {
System.out.println("addr: "+addr.toString());
InetSocketAddress bindToAddress = new InetSocketAddress(addr, COAP_PORT);
System.out.println("bindToAddress: "+bindToAddress.toString());
addEndpoint(new CoapEndpoint(bindToAddress));
}
}
}
Here is the Exception:
Jan 20, 2016 3:24:58 PM org.eclipse.californium.core.network.config.NetworkConfig createStandardWithFile
INFO: Storing standard properties in file Californium.properties
addr: /127.0.0.1
bindToAddress: /127.0.0.1:5683
Exception in thread "main" java.lang.NoClassDefFoundError: org/eclipse/californium/elements/RawDataChannel
at HelloWorldServer.addEndpoints(HelloWorldServer.java:53)
at HelloWorldServer.main(HelloWorldServer.java:34)
Caused by: java.lang.ClassNotFoundException: org.eclipse.californium.elements.RawDataChannel
at java.net.URLClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
... 2 more
I see no file in GitHub Source
org/eclipse/californium/elements/RawDataChannel.java is that is the
problem !?
I tried to clean and rebuild the project still same issue.
Created project again, don't work
Thanks in advance

The answer is old, though maybe the answer will be useful for someone..
There was lack of element-connector library.
I'd recommend to use Maven and add californium as a dependency to pom.xml

Cannot instantiate InitialContext with JBoss server

I'm trying to create a InitialContext so I could ask the JNDI for some enterprise java beans.
The JBoss is running fine, but when I run the java code I get an exception.
I'm running JBoss 7.1
Here is my code:
public class Test {
public static void main(String[] args){
InitialContext ctx=getInitialContext();
Object ref=null;
try {
ref = ctx.lookup("ParamEJB/remote");
} catch (NamingException e) {
System.out.println("Lookup Failed");
e.printStackTrace();
}
Param stub=(Param)PortableRemoteObject.narrow(ref, Param.class);
int times=stub.getTimes();
for(int i=0;i<times;i++)
System.out.println(stub.getMessage());
}
public static InitialContext getInitialContext(){
Hashtable<String,String> h=new Hashtable<String,String>();
h.put("java.naming.factory.initial","org.jnp.interfaces.NamingContextFactory");
h.put("java.naming.provider.url","localhost");
try {
return new InitialContext(h);
} catch (NamingException e) {
System.out.println("Cannot generate InitialContext");
e.printStackTrace();
}
return null;
}
}
And after i start my JBoss server, I try to run the java code and I get this exception:
javax.naming.NoInitialContextException: Cannot instantiate class: org.jnp.interfaces.NamingContextFactory [Root exception is java.lang.ClassNotFoundException: org.jnp.interfaces.NamingContextFactory]
at javax.naming.spi.NamingManager.getInitialContext(Unknown Source)
at javax.naming.InitialContext.getDefaultInitCtx(Unknown Source)
at javax.naming.InitialContext.init(Unknown Source)
at javax.naming.InitialContext.<init>(Unknown Source)
at client.Test.getInitialContext(Test.java:32)
at client.Test.main(Test.java:13)
Caused by: java.lang.ClassNotFoundException: org.jnp.interfaces.NamingContextFactory
at java.net.URLClassLoader$1.run(Unknown Source)
at java.net.URLClassLoader$1.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
What might be the problem?

I had the same problem but I found how to fix it. All you have to do is add the jbossall-client.jar library to the clients project, and done!!! You can find the file inside the client folder. e.g jboss-6.1.0.Final_GPT\client I was using Jboss 6.1.0 You can also get help from this link https://community.oracle.com/thread/1157701?start=0
Hope it helps.

The InitialContext properties are not right for the JBoss version that you are using.
With JBoss 7, things have changed considerably when you call a ejb from a remote client.
This link can help you to instantiate correctly the InitialContex object and to determine the JNDI entry name. Also will tell you what are the necessary dependencies that need to be added to the client classpath.