iaik.security.ssl.SSLException: Peer sent alert: Alert Fatal: handshake

[Former Member]

Hello all,

We're trying to call a web service over HTTPs with client certificate (soapReceiver). Our PI is AS JAVA 7.4 (single stack). We also have another PI 7.4 (Abap and Java Stack for testing purposes). In this scenario our PI acts as a client.

While trying to establish a ssl connection we receive the following error in XPI_INSPECTOR tool in both systems:

The SSL version is 3.1 which corresponds to TLSv1.0, but the server is refusing the connection.

All certificates (Client and CA ) are properly installed in the Keystores and so on. I think there is no problem with that.

The ssl connection works fine with SOAPUI tool so we have analysed the traffic in order to find the differences between PI ssl connection and SOAPUI ssl connection and we've find the following:

With SOAPUI the trace shows a complete ssl connection:

If we deeply debug the "client hello" message and the "server hello" message, we see that the server receives 21 cipher suites from the client and choose one of then.

Client hello message :

Server hello message:

With our PI we have the following trace:

Client hello:

Server hello (not really, because is a handshake failure)

-----------------------------------------------------------------------------------------------------------------------------------------------------

We think the connection is being refused because none of the 35 cipher suites sent by our PI is accepted by the server.

I've read the following threads    , https://scn.sap.com/thread/3852649

but the problem is not exactly the same. The server accepts TLSv1.0 as we've seen in the pictures above.

How can i set/add/modify the cipher suites availables to make ssl connections? Do you think this is the real problem?

Any help or suggestion is welcome.

[former_member204100 · Accepted solution]

Hi José Miguel,

it depends on the JVM version which cipher suites can be used on the servers.

As you can see in this note several cipher suites has been disabled with a JVM patch:

#2199062 - SSL protocol and algorithm deprecation in SAP JVM

Maybe the JVM is on different versions in these systems...

Best Regards,

Viktor

[former_member204100 · Accepted solution]

One more thing. By using "unlimited strength" version of Jurisdiction Policies you can influence the number of the enabled cipher suites. Note:

#739043 - How to Check for Full Strength Jurisdiction Policies

[Former Member · Accepted solution]

Hi Viktor,

I'll follow the steps in SAP note 21999062 in order to know if some cipher suites are being restricted by the JVM in PI server.

However, i'm not sure this is going to work because the ssl connection is using TLSv1.0 which is higher in terms of security than SSLv3.0.

Thank you for your valuable answer.

[apu_das2]

Hi,

Below blog of Eng might help you to resolve this -

Thanks,

Apu

[Former Member]

Hi Apu,

I have followed the same steps than the blog as you can see in the pictures above (ssl debug in xpi_inspector). The SSL connection is failing just after the "client hello" message.

The reason is not specified in xpi_inspector so i have deely debuged the ssl session with another tool which is intended to do this. It shows that the server is refusing the connection because does not accept any of the 35 cipher suites sent by PI server (it's my suspicion).

Now i'm trying to find a solution to include/add/enable the cipher suites which are not refused by the server.

For example: Cipher Suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

Thanks.

[apu_das2]

Hi,

Great that you find the error reason. Please update if you able to resolve this or let us know if you are getting any new error.

Thanks,

Apu

[iaki_vila]

Hi José Miguel,

Could you tell us with other tool you are using?, it will be helpful for all of us.

Regards.

[Former Member]

Hi Iñaki,

The tool is called "Wireshark". You can download for free.

The problem is still not resolved. We're trying to modify the cipher suites sent by our PI when acts as a client in a SSL connection without luck.

We've have applied the OSS note 2092630 but still not working.

Also important that we're using SOAP Receiver adapter which is built in the JAVA stack. Changes in the ABAP stack (ICM and so on) have no effect.

Thanks.

Any help or suggestion is welcome.

[iaki_vila]

Hi José Miguel,

Check the first point in the solution section in this note 2193460 - SSLv3 is disabled in SAP JVM version 4.1, 5.1, 6.1, 8.1

Regards.