we have a client application compiled with JDK1.8, and an external server application runs with JRE1.7 or earlier versions. We don't know the exact JRE version of the server side. The problem here is that we cannot establish secure connections between them. We know that Java 1.8 enables TLS1.2 by default, and according to corresponding RFCs and Oracle blogs, TLS1.2 is compatible with TLS1.1 and TLS1.0. So, even if the server side uses TLS1.1 or 1.0, it should work as expected. We don't know why. The error message says something like "caused by missing of certificates or cipher suite not supported". We also used SSLab to analyze the server side, and got something like "cipher suite not supported or mismatch". Very confusing because if we compile the client side with java1.7, it works fine. Any ideas? Thanks

  • This is more of a Java question than an InfoSec question. Perhaps StackOverflow could help? – schroeder Apr 14 '15 at 3:44

First, enable SSL debugging on the client by setting the javax.net.debug system property from the command line (-Djavax.net.debug=all) or in runtime. Stdout will have quite detailed logging of the SSL connections, as long as you are using the build in SSL provider. More details at: http://docs.oracle.com/javase/1.5.0/docs/guide/security/jsse/ReadDebug.html

Second, check if this bug applies to you: http://bugs.java.com/bugdatabase/view_bug.do?bug_id=8036970

Third, make sure the server is not running SSL 3.0, as it's vulnerable and 1.8u31 and up no longer supports is by default. More info on this at: http://www.oracle.com/technetwork/java/javase/documentation/cve-2014-3566-2342133.html

Not the answer you're looking for? Browse other questions tagged or ask your own question.