0

I am trying to https connection to remote API , used Spring RestTemplate to make the connection .Its a spring boot application

I able to make a connection on my local (oracle JDK 1.8 and tomcat)

When deployed as war in Jboss EAP 7.1.0 GA that uses IBM JDK 1.8, the connection times out and fails. The log below

        SSLContextImpl:  Using X509ExtendedKeyManager com.ibm.jsse2.az
        SSLContextImpl:  Using X509TrustManager com.ibm.jsse2.aD
        JsseJCE:  Using SecureRandom SHA2DRBG from provider IBMJCE version1.8
        trigger seeding of SecureRandom
        done seeding SecureRandom

        Handling error: ResourceAccessException, I/O error on POST request for "https://example.com/auth": 
        A remote host did not respond within the timeout period. (Connection timed out); 
        nested exception is java.net.ConnectException: A remote host did not respond within the timeout period. (Connection timed out):

The same code compiled and packaged with oracle JDK 1.8 work fine in the above mentioned Jboss environment.

I thought it is related to ssl handshake and tried all these options, did not solve my problem. I logged the SSL debug for bothe environments, In the working enviroment i see the Alogrithm and cipher negotiation between server and client after done seeding SecureRandom, but in Jboss IBM JDK 1.8 I dont see anything. after a while it fails with timeout 

        #  JAVA_OPTS="$JAVA_OPTS -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2"
        #  JAVA_OPTS="$JAVA_OPTS -Djdk.tls.client.protocols=TLSv1.2"
        #  JAVA_OPTS="-Dcom.ibm.jsse2.renegotiate=DISABLED"
        #  JAVA_OPTS="-Djdk.tls.allowUnsafeServerCertChange=true"
        #  JAVA_OPTS="-Djdk.tls.disabledAlgorithms=SSLv3,TLSv1,TLSv1.1"
        #  JAVA_OPTS="$JAVA_OPTS -Dcom.ibm.jsse2.overrideDefaultTLS=true"
        #  JAVA_OPTS="$JAVA_OPTS -Djavax.net.ssl.trustStore=trustStore"*
James R. Perkins
  • 16,800
  • 44
  • 60
mahesh kumar
  • 1
  • 1
  • It seems it should be supported https://access.redhat.com/articles/2026253. You may want to contact support in this case. – James R. Perkins Nov 07 '19 at 17:27
  • Your error is at **network level** not in SSL/TLS=JSSE[2]. Can you try ping or telnet or netcat/ncat/nc/socat from same source to same target? Can you monitor with netstat or similar and see if the connection attempt is using the same protocol (IPv4/IPv6) and address? Or get a net capture like tcpdump or wireshark? (Last usually requires root or capability, which may be an issue on a prod machine.) – dave_thompson_085 Nov 07 '19 at 18:25

0 Answers0