"java.io.EOFException: SSL peer shut down incorrectly" thrown when not using SSL

Question

I am unable to connect VisualVM to a remote JVM. I have started the remote JVM with the following parameters:

 java -Dcom.sun.management.jmxremote -Dcom.sun.management.jmxremote.local.only=false -Dcom.sun.management.jmxremote.port=9000 -Dcom.sun.management.jmxremote.ssl=false -Dcom.sun.management.jmxremote.authenticate=false -Djava.rmi.server.hostname=[server ip] -Dlog4j.configurationFile=file:///home/ubuntu/servicesLog4j2.xml -jar /home/ubuntu/Program.jar &

Note the -Dcom.sun.management.jmxremote.ssl=false

I then start VisualVM and add a new JMX connection to the server. I specifically check the option:

Do not require SLL connection

When the connection fails, I can see the following error in the VisualVM log. I am unsure why SSL is involved if I have disabled SSL with a flag on the remote VM and specified not to require SSL in VisualVM. But it would appear this error is preventing the connection. What am I missing?

java.io.EOFException: SSL peer shut down incorrectly
    at sun.security.ssl.InputRecord.read(InputRecord.java:505)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:954)
Caused: javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343)
    at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:728)
    at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123)
    at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
    at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
    at java.io.DataOutputStream.flush(DataOutputStream.java:123)
    at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:229)
Caused: java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is: 
    javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake
    at sun.rmi.transport.tcp.TCPChannel.createConnection(TCPChannel.java:304)
    at sun.rmi.transport.tcp.TCPChannel.newConnection(TCPChannel.java:202)
    at sun.rmi.server.UnicastRef.newCall(UnicastRef.java:342)
    at sun.rmi.registry.RegistryImpl_Stub.lookup(Unknown Source)
    at com.sun.jndi.rmi.registry.RegistryContext.lookup(RegistryContext.java:118)
Caused: javax.naming.CommunicationException [Root exception is java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is: 
    javax.net.ssl.SSLHandshakeException: Remote host closed connection during handshake]
    at com.sun.jndi.rmi.registry.RegistryContext.lookup(RegistryContext.java:122)
    at com.sun.jndi.toolkit.url.GenericURLContext.lookup(GenericURLContext.java:205)
    at javax.naming.InitialContext.lookup(InitialContext.java:417)
    at javax.management.remote.rmi.RMIConnector.findRMIServerJNDI(RMIConnector.java:1929)
    at javax.management.remote.rmi.RMIConnector.findRMIServer(RMIConnector.java:1896)
    at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:287)
Caused: java.io.IOException: Failed to retrieve RMIServer stub
    at javax.management.remote.rmi.RMIConnector.connect(RMIConnector.java:369)
    at com.sun.tools.visualvm.jmx.impl.JmxModelImpl$ProxyClient.tryConnect(JmxModelImpl.java:569)
[catch] at com.sun.tools.visualvm.jmx.impl.JmxModelImpl$ProxyClient.connect(JmxModelImpl.java:506)
    at com.sun.tools.visualvm.jmx.impl.JmxModelImpl.connect(JmxModelImpl.java:234)
    at com.sun.tools.visualvm.jmx.impl.JmxModelImpl.<init>(JmxModelImpl.java:223)
    at com.sun.tools.visualvm.jmx.impl.JmxModelProvider.createModelFor(JmxModelProvider.java:60)
    at com.sun.tools.visualvm.jmx.impl.JmxModelProvider.createModelFor(JmxModelProvider.java:41)
    at com.sun.tools.visualvm.core.model.ModelFactory.getModel(ModelFactory.java:111)
    at com.sun.tools.visualvm.tools.jmx.JmxModelFactory.getJmxModelFor(JmxModelFactory.java:69)
    at com.sun.tools.visualvm.jmx.impl.JmxApplicationProvider.addJmxApplication(JmxApplicationProvider.java:295)
    at com.sun.tools.visualvm.jmx.impl.JmxApplicationProvider.createJmxApplication(JmxApplicationProvider.java:200)
    at com.sun.tools.visualvm.jmx.JmxApplicationsSupport.createJmxApplicationImpl(JmxApplicationsSupport.java:319)
    at com.sun.tools.visualvm.jmx.JmxApplicationsSupport.createJmxApplicationInteractive(JmxApplicationsSupport.java:296)
    at com.sun.tools.visualvm.jmx.impl.AddJMXConnectionAction$1.run(AddJMXConnectionAction.java:80)
    at org.openide.util.RequestProcessor$Task.run(RequestProcessor.java:1423)
    at org.openide.util.RequestProcessor$Processor.run(RequestProcessor.java:2033)

Is the connection going through a proxy? – Developer Marius Žilėnas Apr 23 '15 at 05:14 — Developer Marius Žilėnas, Apr 23 '15 at 05:14

yonibenitez · Answer 1 · 2019-03-18T04:44:08.223

4

How I managed to solve this after some headaches:

If you have a firewall at the remote machine, you might have issues with the second random port (where remote objects are exported). Try to disable the firewall and if it works then you might have to do something like this. Tomcat have a listener to solve it: link
Make sure that the value under -Djava.rmi.server.hostname resolves to the host from your client location (that was my case)
And finally jconsole (at the JDK bin folder, the same than VisualVM) provides very useful information. Execute it from a console with the -debug option. With the debug option, Jconsole will pop up stacktraces explaining the real reason why your client can't connect. When you try to connect to nonSSL servers JConsole will initially fail and then it will ask you to connect "insecure", next you'll see the real reason, in my case it was looking for the object export port at the loopback IP 127.0.0.1 (because I wasn't using the -Djava.rmi.server.hostname option).

Hope it helps!

edited Mar 18 '19 at 04:44

answered Mar 18 '19 at 04:07

yonibenitez

49
4

This problem was caused at the initial port, the Registry port, while doing the lookup. Not calling the object on its own port. See the star trace. Wrong port would give you a connection refusal. Firewall port non-open would cause a connection timeout. Wrong hostname would cause a refusal or timeout. None of these would cause the OP's error. – user207421 Mar 18 '19 at 05:36
I understand your concerns regarding about what the stacktrace says and what it seems to be happening. I had the exact same stacktrace when I fixed this issue. The first thing that brought me some concerns is why a SSL handshake issue is arising when no SSL should be involved? The answer is that VisialVM is backing to SSL after an unsuccessful nonSSL attempt and hiding the real exception cause. In summary don't trust VisualVM logs when dealing with non secure connections, do it through jconsole. – yonibenitez Mar 19 '19 at 15:38

"java.io.EOFException: SSL peer shut down incorrectly" thrown when not using SSL

1 Answers1