SSL/TLS Connection reset - how to force Java client to use SNI?

Question

I had BOTH: a STS server and spring web application on localhost. And it worked. I've tested OAuth2 Authorization Code Grant Flow - fully working.

I moved STS to other machine and there is a problem from web application in acquiring an access token - full trace (stop/error after redirection from STS; just in the beginning of acquiring token from: https://sts-machine/authz/oauth2-resource/oauth/token endpoint; stop at visiting url: https://localwebapp:7443/swd/webLogin?code=306b88903d394f0b8145b2e8035fd306&state=PtTrt8):

SEVERE: Servlet.service() for servlet [swdServlet] in context with path [/swd] threw exception
error="access_denied", error_description="Error requesting access token."
    at org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport.retrieveToken(OAuth2AccessTokenSupport.java:144)
    at org.springframework.security.oauth2.client.token.grant.code.AuthorizationCodeAccessTokenProvider.obtainAccessToken(AuthorizationCodeAccessTokenProvider.java:198)
    at org.springframework.security.oauth2.client.token.AccessTokenProviderChain.obtainNewAccessTokenInternal(AccessTokenProviderChain.java:142)
    at org.springframework.security.oauth2.client.token.AccessTokenProviderChain.obtainAccessToken(AccessTokenProviderChain.java:118)
    at org.springframework.security.oauth2.client.OAuth2RestTemplate.acquireAccessToken(OAuth2RestTemplate.java:221)
    at org.springframework.security.oauth2.client.OAuth2RestTemplate.getAccessToken(OAuth2RestTemplate.java:173)
    at org.springframework.security.oauth2.client.filter.OAuth2ClientAuthenticationProcessingFilter.attemptAuthentication(OAuth2ClientAuthenticationProcessingFilter.java:90)
    at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:211)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.oauth2.client.filter.OAuth2ClientContextFilter.doFilter(OAuth2ClientContextFilter.java:57)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:103)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:154)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:50)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:108)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.access.channel.ChannelProcessingFilter.doFilter(ChannelProcessingFilter.java:144)
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:192)
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:160)
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:344)
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:261)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:239)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:219)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:503)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:136)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:610)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:526)
    at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1078)
    at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:655)
    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:146)
    at org.apache.tomcat.util.net.JIoEndpoint$SocketProcessor.run(JIoEndpoint.java:279)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:745)
Caused by: org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://sts-machine/authz/oauth2-resource/oauth/token":Connection reset; nested exception is java.net.SocketException: Connection reset
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:557)
    at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:510)
    at org.springframework.security.oauth2.client.token.OAuth2AccessTokenSupport.retrieveToken(OAuth2AccessTokenSupport.java:136)
    ... 47 more
Caused by: java.net.SocketException: Connection reset
    at java.net.SocketInputStream.read(SocketInputStream.java:196)
    at java.net.SocketInputStream.read(SocketInputStream.java:122)
    at sun.security.ssl.InputRecord.readFully(InputRecord.java:442)
    at sun.security.ssl.InputRecord.read(InputRecord.java:480)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:927)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:153)
    at org.springframework.http.client.SimpleBufferingClientHttpRequest.executeInternal(SimpleBufferingClientHttpRequest.java:78)
    at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:46)
    at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:52)
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:541)
    ... 49 more

So there is connection reset when webapp tries to exchange "code" from access token from: https://sts-machine/authz/oauth2-resource/oauth/token.

Fun fact: Making request manually works well! (Manually exchanging code for access token) Tested with Chrome application "Advanced Rest Client Application" and with "Fiddler" request composer.

I sniffed both machines using wiresharks. Same result on both - screenshot: https://i.stack.imgur.com/CsLJR.png (where: 10.1.0.121 is localwebapp machine, and: 10.1.0.80 is sts-machine)

Why there is connection reset?

Details about config:

localwebapp: runs on tc Pivotal Server (kinda Tomcat), Win 8.1

sts-machine: is Thinktecture Authorization Server on IIS, Win Server 2012

UPDATE 1

What I found out that: openssl s_client -connect sts-machine:443 does not work, but: openssl s_client -connect sts-machine:443 -servername sts-machine does work! This indicates issue with the SNI on Java client. Tried to solve problem with setting system property: jsse.enableSNIExtension to true, but without any success... How to enforce JVM to use SNI?

When I change the address to one without SSL (HTTP not HTTP**S**): `http://sts-machine/authz/oauth2-resource/oauth/token` everything goes fine. So I assume there is a problem with SSL/TLS layer. I tried to force Tomcat to use at least TLSv1, by setting JAVA_OPTS=-Dhttps.protocols="TLSv1,TLSv1.1,TLSv1.2" -Djdk.tls.client.protocols="TLSv1,TLSv1.1,TLSv1.2" and in server.xml SSL connector I set up sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2". But still error 500 with https connection... Any idea? — Dave Yarsky, Jan 07 '15 at 09:31
SNI is available from Java 7 only, are you running that version? You should enable JSSE debug output. — Michael-O, Jan 08 '15 at 09:51
Just checked with jinfo: `java.runtime.version = 1.7.0_60-b19` so SNI should be enabled by default. I run server with `-Djavax.net.debug=SSL,handshake,trustmanager` option, which results in [extended trace](https://gist.github.com/anonymous/64994051ae1f0c344c17) . I also used simple console [SSLPoke](https://confluence.atlassian.com/download/attachments/117455/SSLPoke.java) with jre7 and jre8-same problem. — Dave Yarsky, Jan 08 '15 at 11:11
I have the same issue when I enforce TLS in my proxy (nginx). More or less the same stacktrace when I enabled SSL debugging. Did you find out anything more? — Jeroen Rosenberg, Feb 09 '15 at 17:02
Unfortunately this is still an unsolved problem for me. I did not find a proper solution. Because on IIS i have only one website I disabled SNI option on the server side so JVM ("client side") doesn't use it. — Dave Yarsky, Feb 11 '15 at 06:29

score 4 · Answer 1 · answered Apr 15 '15 at 14:23

Can you specify which Spring version you are using? We fought our SNI bug today and the solution was: * Upgrade to commons/httpclient 4.3.2+ (we use 4.3.5) * Important! Replace DefaultHttpClient with HttpClientBuilder as DefaultHttpClient is still shipped with httpclient 4.3.x but does NOT support SNI

score 0 · Answer 2 · answered Jan 16 '20 at 20:34

0

I had the same problem and also had an older version of HttpClient. I upgraded Java from 1.8.0_92 to 1.8.0_241 and the problem was solved.

answered Jan 16 '20 at 20:34

Raidok

774
8
19

SSL/TLS Connection reset - how to force Java client to use SNI?

UPDATE 1

2 Answers2