[jira] [Issue Comment Deleted] (DIRSERVER-2318) StartTLS and LDAPS are not working

["Matt Pavlovich (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/DIRSERVER-2318?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Matt Pavlovich updated DIRSERVER-2318:
--------------------------------------
    Comment: was deleted

(was: I wonder if this is related. Appears to be attempting to initialize SSLEngine using the "SSL" protocol which has been disabled/removed from newer JDK's.

{noformat}
[20:57:23] WARN [org.apache.mina.util.DefaultExceptionMonitor] - Unexpected exception.
org.apache.mina.core.filterchain.IoFilterLifeCycleException: onPreAdd(): sslFilter:SslFilter in (0x00015E84: nio socket, server, /192.168.2.239:60279 => /192.168.2.75:10636)
	at org.apache.mina.core.filterchain.DefaultIoFilterChain.register(DefaultIoFilterChain.java:383)
	at org.apache.mina.core.filterchain.DefaultIoFilterChain.addLast(DefaultIoFilterChain.java:189)
	at org.apache.mina.core.filterchain.DefaultIoFilterChainBuilder.buildFilterChain(DefaultIoFilterChainBuilder.java:496)
	at org.apache.mina.core.polling.AbstractPollingIoProcessor.addNow(AbstractPollingIoProcessor.java:512)
	at org.apache.mina.core.polling.AbstractPollingIoProcessor.handleNewSessions(AbstractPollingIoProcessor.java:487)
	at org.apache.mina.core.polling.AbstractPollingIoProcessor.access$400(AbstractPollingIoProcessor.java:68)
	at org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:1111)
	at org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
	at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.IllegalArgumentException: SSL
	at sun.security.ssl.ProtocolVersion.valueOf(ProtocolVersion.java:187)
	at sun.security.ssl.ProtocolList.convert(ProtocolList.java:84)
	at sun.security.ssl.ProtocolList.<init>(ProtocolList.java:52)
	at sun.security.ssl.SSLEngineImpl.setEnabledProtocols(SSLEngineImpl.java:2070)
	at org.apache.mina.filter.ssl.SslHandler.init(SslHandler.java:180)
	at org.apache.mina.filter.ssl.SslFilter.onPreAdd(SslFilter.java:445)
	at org.apache.mina.core.filterchain.DefaultIoFilterChain.register(DefaultIoFilterChain.java:381)
	... 10 more
{noformat}
)

> StartTLS and LDAPS are not working
> ----------------------------------
>
>                 Key: DIRSERVER-2318
>                 URL: https://issues.apache.org/jira/browse/DIRSERVER-2318
>             Project: Directory ApacheDS
>          Issue Type: Bug
>          Components: ldap, security
>    Affects Versions: 2.0.0-M24, 2.0.0.AM26
>         Environment: Ubuntu 20.04 clean installation used for both client and server.  Used version 2.0.0~M24-3 from Ubuntu repository and version 2.0.0.AM26 deb package from official website.  Using openjdk-14-jre and openjdk-11-jre from Ubuntu repository.  Apache Studio 2.0.0-M15 from website.
>            Reporter: Karl Frauendienst
>            Priority: Major
>         Attachments: Apache_Studio_StartTLS.log
>
>
> Attempting to make a secure LDAP connection results in handshake failure with unknown error.  No error with unencrypted connections.  Tested on two separate systems.
> First setup: Ubuntu Server 20.04 with apacheds 2.0.0~M24-3 installed from repository.  Tried both default-jre (openjdk-11-jre) and openjdk-14-jre.  Running Apache Studio 2.0.0-M15 from official website on a separate Ubuntu Desktop 20.04 system and tested with same two jre versions.  On this setup, I occasionally got an error stating the key was only 512 bits, so I used keytool according to the ApacheDS getting started guide to create and use a 2048 bit keypair.  Following that I only get the handshake failure.
> Second setup: Ubuntu Desktop 20.04 running openjdk-14-jre with ApacheDS 2.0.0.AM26 deb pkg and Apache Studio 2.0.0-M15 from official website.  This produces the handshake error.  I believe the issue is server side because I can produce a similar handshake error using ldapsearch.  It works fine unencrypted, but fails using either StartTLS on port 10389 or LDAPS on 10636. I did not replace the keypair in this setup.  This setup occasionally will work with StartTLS and LDAPS but will seemingly work or not work intermittently with no configuration changes being made.
> I have tested with Apache Studio SSL verification both enabled and disabled in both cases.
> Errors produced include:
> !MESSAGE Improper close state: Status = OK HandshakeStatus = NEED_WRAP
> !MESSAGE The authentication failed
>  - ERR_04120_TLS_HANDSHAKE_ERROR The TLS handshake failed, reason: Unspecified
> !MESSAGE org.apache.directory.api.ldap.model.exception.LdapTlsHandshakeException: ERR_04120_TLS_HANDSHAKE_ERROR The TLS handshake failed, reason: Unspecified
> !MESSAGE ERR_01200_BAD_TRANSITION_FROM_STATE Bad transition from state START_STATE, tag 0x15
> !MESSAGE org.apache.directory.api.ldap.codec.api.ResponseCarryingException: ERR_01200_BAD_TRANSITION_FROM_STATE Bad transition from state START_STATE, tag 0x15
> !MESSAGE Error while opening connection
>  - PROTOCOL_ERROR: The server will disconnect!



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org