文档建议反馈控制台
首页
学习
活动
专区
圈层
工具
MCP广场
文章/答案/技术大牛
发布
首页
学习
活动
专区
圈层
工具
MCP广场
返回腾讯云官网
社区首页 >问答首页 >Java升级8到11，导致LDAPS连接出现问题(连接或出站已关闭)

问Java升级8到11，导致LDAPS连接出现问题(连接或出站已关闭)
EN

Stack Overflow用户
提问于 2019-11-18 09:52:49
回答 3查看 12.7K关注 0票数 4

在java升级之后出现了这个问题：

使用DNS别名的

  • LDAP不与java 11.0.2连接，因为它与java 8

一起工作。

如下所示的DNS别名不变，此处仅更改为java升级8至11：

$ nslookup ad1.XXXXX.zz

代码语言：javascript
运行
复制
Server:         10.222.249.209
Address:        10.222.249.209#53

Name:   ad1.XXXXX.zz
Address: 10.222.249.205
Name:   ad1.XXXXX.zz
Address: 10.222.249.204
Name:   ad1.XXXXX.zz
Address: 10.222.249.210

  • LDAP直接IP与java11.0.2工作它没有问题：

$ nslookup qdegsf.XXXXX.zz

代码语言：javascript
运行
复制
Server:         10.222.249.209
Address:        10.222.249.209#53

Name:   qdegsf.XXXXX.zz
Address: 10.222.249.210

工艺参数：

/opt/3rdparty/jdk_installed/jdk-11.0.2/bin/java -Dsserver -Djdk.serialFilter=* -Dfile.encoding=UTF8 -Djavax.net.ssl.trustStorePassword=XXXX -Djavax.net.ssl.keyStore=/opt/3rdparty/tomcat/conf/svrkeystore.jks

下面是ldap连接时的问题跟踪

代码语言：javascript
运行
复制
java.lang.RuntimeException: connection to ldap server failed;url;ldaps://ad1.XXXXX.zz:636;authDN;sa_XXX@XXXXX.zz
javax.naming.CommunicationException: simple bind failed: ad1.XXXXX.zz:636 [Root exception is java.net.SocketException: Connection or outbound has closed]
java.net.SocketException: Connection or outbound has closed
Trace for the thrown exceptions:
java.lang.RuntimeException: connection to ldap server failed;url;ldaps://ad1.XXXXX.zz:636;authDN;sa_XXX@XXXXX.zz
    at auth.ldap.LdapConnection.testConnection(LdapConnection.java:46)


Caused by: javax.naming.CommunicationException: simple bind failed: ad1.XXXXX.zz:636 [Root exception is java.net.SocketException: Connection or outbound has closed]
    at java.naming/com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:219)
    at java.naming/com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2795)
    at java.naming/com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:320)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:153)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:83)
    at java.naming/javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:730)
    at java.naming/javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
    at java.naming/javax.naming.InitialContext.init(InitialContext.java:236)
    at java.naming/javax.naming.InitialContext.<init>(InitialContext.java:208)
    at java.naming/javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:101)
    at auth.ldap.LdapConnection.testConnection(LdapConnection.java:41)
    ... 3 more
Caused by: java.net.SocketException: Connection or outbound has closed
    at java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:976)
    at java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:81)
    at java.base/java.io.BufferedOutputStream.flush(BufferedOutputStream.java:142)
    at java.naming/com.sun.jndi.ldap.Connection.writeRequest(Connection.java:398)
    at java.naming/com.sun.jndi.ldap.Connection.writeRequest(Connection.java:371)
    at java.naming/com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:359)
    at java.naming/com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:214)
    ... 15 more
javax.naming.CommunicationException: simple bind failed: ad1.XXXXX.zz:636 [Root exception is java.net.SocketException: Connection or outbound has closed]
    at java.naming/com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:219)
    at java.naming/com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2795)
    at java.naming/com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:320)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:153)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:83)
    at java.naming/javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:730)
    at java.naming/javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
    at java.naming/javax.naming.InitialContext.init(InitialContext.java:236)
    at java.naming/javax.naming.InitialContext.<init>(InitialContext.java:208)
    at java.naming/javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:101)
    at auth.ldap.LdapConnection.testConnection(LdapConnection.java:41)
Caused by: java.net.SocketException: Connection or outbound has closed
    at java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:976)
    at java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:81)
    at java.base/java.io.BufferedOutputStream.flush(BufferedOutputStream.java:142)
    at java.naming/com.sun.jndi.ldap.Connection.writeRequest(Connection.java:398)
    at java.naming/com.sun.jndi.ldap.Connection.writeRequest(Connection.java:371)
    at java.naming/com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:359)
    at java.naming/com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:214)
    ... 15 more
java.net.SocketException: Connection or outbound has closed
    at java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:976)
    at java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:81)
    at java.base/java.io.BufferedOutputStream.flush(BufferedOutputStream.java:142)
    at java.naming/com.sun.jndi.ldap.Connection.writeRequest(Connection.java:398)
    at java.naming/com.sun.jndi.ldap.Connection.writeRequest(Connection.java:371)
    at java.naming/com.sun.jndi.ldap.LdapClient.ldapBind(LdapClient.java:359)
    at java.naming/com.sun.jndi.ldap.LdapClient.authenticate(LdapClient.java:214)
    at java.naming/com.sun.jndi.ldap.LdapCtx.connect(LdapCtx.java:2795)
    at java.naming/com.sun.jndi.ldap.LdapCtx.<init>(LdapCtx.java:320)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURL(LdapCtxFactory.java:192)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getUsingURLs(LdapCtxFactory.java:210)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getLdapCtxInstance(LdapCtxFactory.java:153)
    at java.naming/com.sun.jndi.ldap.LdapCtxFactory.getInitialContext(LdapCtxFactory.java:83)
    at java.naming/javax.naming.spi.NamingManager.getInitialContext(NamingManager.java:730)
    at java.naming/javax.naming.InitialContext.getDefaultInitCtx(InitialContext.java:305)
    at java.naming/javax.naming.InitialContext.init(InitialContext.java:236)
    at java.naming/javax.naming.InitialContext.<init>(InitialContext.java:208)
    at java.naming/javax.naming.directory.InitialDirContext.<init>(InitialDirContext.java:101)
    at nims.auth.ldap.LdapConnection.testConnection(LdapConnection.java:41)
    at auth.LdapAuthenticationService.doTestConnection(LdapAuthenticationService.java:50)

>在以下更新错误时:

$ openssl s_client -connect ad1.XXXXX-ru.zz:636

连接(00000003) depth=0验证error:num=20：无法获得本地颁发证书验证返回:1 depth=0验证error:num=27：证书不受信任验证返回:1 depth=0验证error:num=21：无法验证第一个证书验证返回:1

证书链0 s: i:/DC=zz/DC=XXXXX-ru/CN=XXXXX-ru-ROOT-CA

服务器证书-开始证书- MIIFfjCCBGagAwIBAgITLwAAAKgllUHEZUjzRwAAAAAAqDANBgkqhkiG9w0BA.................

APpwNrloBJjZo2bJ7pqe4gXN

subject=发行者=/DC=zz/DC=XXXXX-ru/CN=XXXXX-ru-ROOT-CA

没有发送服务器临时密钥的客户端证书CA名称: ECDH，prime256v1,256位

SSL握手已经读取了1980字节，写入了441字节。

新的，TLSv1 1/SSLv3，3，支持压缩:无扩展:无SSL-会话:协议: 1574232095超时: 300 (秒)验证返回代码: 21 (无法验证第一个证书)：21(无法验证第一个证书)

请提供建议。谢谢

java
ldap
EN

Stack Overflow用户

回答已采纳

发布于 2021-10-24 02:43:26

编写了一个测试脚本，用于连接ldap (启用ssl日志)@ jdk 11

/opt/soft/jdk_installed/jdk-11.0.2/bin/java -Djavax.net.ssl.trustStore=/opt/soft/tomcat/conf/svrtrust -XX:+UseSerialGC -DLdapsConnect -Djavax.net.debug=all -Djavax.net.ssl.trustStorePassword=hsqlIiza -Djavax.net.ssl.keyStorePassword=hsqlIiza -classpath /tmp/ LdapsConnect $*

在ssl日志中发现以下错误:javax.net.ssl、error \1D、Thread-0、2020-01-22、10:55:21.632 CET|TransportContext.java:313|Fatal (CERTIFICATE_UNKNOWN)：没有找到与ad1.xxxx.zz匹配的主题DNS名称。

结论/解决方案: Ldap证书应修改为缺少的ad1.ngssm-ru.zz。因为Java 8u181在ldap支持中有如下更改，这不允许在JavaVersion8u181和更高版本之后使用旧的方式。

Java正在尝试确保连接配置中的主机名与远程LDAPS TLS服务器证书中的主机名匹配，并且证书中的那些主机名是有效的。安全连接的正确解决方案是让LDAP服务器管理员更正ldap服务器正在使用的ldap证书，以便改进的端点识别算法能够工作。这是为了保护我们。

https://www.oracle.com/technetwork/java/javase/8u181-relnotes-4479407.html改变核心库/javax.name？在LDAPS连接上启用了LDAP支持端点标识。

为了提高LDAPS (secure )连接的鲁棒性，在默认情况下启用了端点识别算法。

请注意，在某些情况下，以前能够成功连接到LDAPS服务器的一些应用程序可能不再能够这样做。这类应用程序如果认为合适，可以使用新的系统属性: com.sun.jndi.ldap.object.disableEndpointIdentification.禁用端点标识。

定义此系统属性(或将其设置为true)以禁用端点标识算法。

票数 0
EN
查看全部 3 条回答
页面原文内容由Stack Overflow提供。腾讯云小微IT领域专用引擎提供翻译支持
原文链接：

https://stackoverflow.com/questions/58911874

复制
相关文章

相似问题

领券

腾讯云开发者

扫码关注腾讯云开发者

扫码关注腾讯云开发者

领取腾讯云代金券

热门产品

热门推荐

更多推荐

Copyright © 2013 - 2025 Tencent Cloud. All Rights Reserved. 腾讯云 版权所有 

深圳市腾讯计算机系统有限公司 ICP备案/许可证号：粤B2-20090059 深公网安备号 44030502008569

腾讯云计算（北京）有限责任公司 京ICP证150476号 |  京ICP备11018762号 | 京公网安备号11010802020287

问题归档专栏文章快讯文章归档关键词归档开发者手册归档开发者手册 Section 归档