SSLHandshakeException：无法验证 ECDH ServerKeyExchange 签名

Question

域名是

cloudauth.aliyuncs.com

。

• okhttp-3.12.13.jar

• 操作系统：Alpine 3.9.4
• openjdk版本“1.8.0_275”

• tea-util-0.2.21.jar

  https://github.com/aliyun/tea-util/tree/master/java

• tea-1.2.0.jar

  https://github.com/aliyun/tea-java

com.aliyun.tea.TeaUnretryableException: Cannot verify ECDH ServerKeyExchange signature
    at com.aliyun.teaopenapi.Client.doRequest(Client.java:865)
    at com.aliyun.teaopenapi.Client.callApi(Client.java:1022)
    at com.aliyun.cloudauth20190307.Client.initFaceVerifyWithOptions(Client.java:893)
    at com.aliyun.cloudauth20190307.Client.initFaceVerify(Client.java:898)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
Caused by: com.aliyun.tea.TeaRetryableException: Cannot verify ECDH ServerKeyExchange signature
    at com.aliyun.tea.Tea.doAction(Tea.java:70)
    at com.aliyun.tea.Tea.doAction(Tea.java:82)
    at com.aliyun.teaopenapi.Client.doRequest(Client.java:784)
    ... 48 common frames omitted
Caused by: javax.net.ssl.SSLHandshakeException: Cannot verify ECDH ServerKeyExchange signature
    at sun.security.ssl.Alert.createSSLException(Alert.java:131)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:324)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:267)
    at sun.security.ssl.ECDHServerKeyExchange$ECDHServerKeyExchangeMessage.<init>(ECDHServerKeyExchange.java:325)
    at sun.security.ssl.ECDHServerKeyExchange$ECDHServerKeyExchangeConsumer.consume(ECDHServerKeyExchange.java:527)
    at sun.security.ssl.ServerKeyExchange$ServerKeyExchangeConsumer.consume(ServerKeyExchange.java:111)
    at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:377)
    at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
    at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:422)
    at sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)
    at sun.security.ssl.SSLTransport.decode(SSLTransport.java:149)
    at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1143)
    at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1054)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:394)
    at okhttp3.internal.connection.RealConnection.connectTls(RealConnection.java:320)
    at okhttp3.internal.connection.RealConnection.establishProtocol(RealConnection.java:284)
    at okhttp3.internal.connection.RealConnection.connect(RealConnection.java:169)
    at okhttp3.internal.connection.StreamAllocation.findConnection(StreamAllocation.java:258)
    at okhttp3.internal.connection.StreamAllocation.findHealthyConnection(StreamAllocation.java:135)
    at okhttp3.internal.connection.StreamAllocation.newStream(StreamAllocation.java:114)
    at okhttp3.internal.connection.ConnectInterceptor.intercept(ConnectInterceptor.java:42)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121)
    at okhttp3.internal.cache.CacheInterceptor.intercept(CacheInterceptor.java:93)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121)
    at okhttp3.internal.http.BridgeInterceptor.intercept(BridgeInterceptor.java:93)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)
    at okhttp3.internal.http.RetryAndFollowUpInterceptor.intercept(RetryAndFollowUpInterceptor.java:127)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:147)
    at okhttp3.internal.http.RealInterceptorChain.proceed(RealInterceptorChain.java:121)
    at okhttp3.RealCall.getResponseWithInterceptorChain(RealCall.java:257)
    at okhttp3.RealCall.execute(RealCall.java:93)
    at com.aliyun.tea.Tea.doAction(Tea.java:67)
    ... 50 common frames omitted
Caused by: java.security.SignatureException: Could not verify signature
    at sun.security.ec.ECDSASignature.engineVerify(ECDSASignature.java:413)
    at java.security.Signature$Delegate.engineVerify(Signature.java:1394)
    at java.security.Signature.verify(Signature.java:771)
    at sun.security.ssl.ECDHServerKeyExchange$ECDHServerKeyExchangeMessage.<init>(ECDHServerKeyExchange.java:320)
    ... 83 common frames omitted
Caused by: java.security.InvalidAlgorithmParameterException: null
    at sun.security.ec.ECDSASignature.verifySignedDigest(Native Method)
    at sun.security.ec.ECDSASignature.engineVerify(ECDSASignature.java:408)
    ... 86 common frames omitted

Answer 1

我自己也遇到过同样的问题，JDK版本为1.8.0_312。我将JDK升级到1.8.0_412版本后问题得到解决。尽管如此，我仍然不清楚这个问题的根本原因。