VIP and PKI Web Services: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

Products

• VIP Software Development Kit

Issue/Introduction

Accessing a Web Services end-point throws ssl handshake error

 

The error is specific to the application. Here are some examples:

Handshake error:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure 

Certificate \ chain errors:
Feb 01 17:21:43 ERROR AxisFault
Feb 01 17:21:43 ERROR faultCode: {http://schemas.xmlsoap.org/soap/envelope/}Server.userException
Feb 01 17:21:43 ERROR faultSubcode:
Feb 01 17:21:43 ERROR faultString: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
Feb 01 17:21:43 ERROR faultActor:
Feb 01 17:21:43 ERROR faultNode:
Feb 01 17:21:43 ERROR faultDetail:
Feb 01 17:21:43 ERROR {http://xml.apache.org/axis/}stackTrace:javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure 

Cipher Errors:
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256 for TLSv1 

Resolution

First, enable an SSL debugging. These logs indicate the reason the handshake if failing. 

Common causes:

1. Check the URL of the end-point in the script. The correct end-point URLs are documented in the respective user's guide.
2. Ensure that the root CA exists on the host in the Trusted Root store. Web Services require either the G2 Root CA (Click Here) and\or the G5 Root CA (Click Here)
3. Update the server application. Older applications may not contain the ciphers required to compelete the handshake