Здравствуйте.
Тестируем работу Tomcat 7.0.29 + JCP 2.0.37027 + JTLS 2.0.37027. Серверная часть работает под управлением Windows 7 [Version 6.1.7601] Профессиональная 32bit, установлена jre 1.7.0_21, КриптоПро CSP R3 3.6.7491. Установили, настроили. С сервера на сайт заходит без проблем, однако при попытке зайти на сайт с любой другой машины в сети IE пишет что "не удалось отобразить страницу".
Настройки коннектора:
Код:<Connector port="443" maxHttpHeaderSize="8192"
protocol="org.apache.coyote.http11.Http11NioProtocol"
SSLEnabled="true"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" scheme="https" secure="true"
clientAuth="false"
sslProtocol="GostTLS"
algorithm="GostX509"
keystoreProvider="JCP"
keystoreFile="C:\s.store"
keystorePass="123"
keystoreType="HDImageStore"
keyalg="GOST3410"
sigalg="GOST3411withGOST3410EL" />
Лог запуска Tomcat:
окт 31, 2013 4:28:13 PM org.apache.catalina.core.AprLifecycleListener init
INFO: Loaded APR based Apache Tomcat Native library 1.1.24 using APR version 1.4.6.
окт 31, 2013 4:28:13 PM org.apache.catalina.core.AprLifecycleListener init
INFO: APR capabilities: IPv6 [true], sendfile [true], accept filters [false], random [true].
окт 31, 2013 4:28:13 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'maxSpareThreads' to '75' did not find a matching property.
окт 31, 2013 4:28:13 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'keyalg' to 'GOST3410' did not find a matching property.
окт 31, 2013 4:28:13 PM org.apache.catalina.startup.SetAllPropertiesRule begin
WARNING: [SetAllPropertiesRule]{Server/Service/Connector} Setting property 'sigalg' to 'GOST3411withGOST3410EL' did not find a matching property.
окт 31, 2013 4:28:14 PM org.apache.catalina.core.AprLifecycleListener initializeSSL
INFO: OpenSSL successfully initialized (OpenSSL 1.0.1c 10 May 2012)
окт 31, 2013 4:28:15 PM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["http-apr-80"]
окт 31, 2013 4:28:15 PM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["http-nio-443"]
окт 31, 2013 4:28:16 PM org.apache.tomcat.util.net.NioSelectorPool getSharedSelector
INFO: Using a shared selector for servlet write/read
окт 31, 2013 4:28:16 PM org.apache.coyote.AbstractProtocol init
INFO: Initializing ProtocolHandler ["ajp-apr-8009"]
окт 31, 2013 4:28:16 PM org.apache.catalina.startup.Catalina load
INFO: Initialization processed in 3888 ms
окт 31, 2013 4:28:16 PM org.apache.catalina.core.StandardService startInternal
INFO: Starting service Catalina
окт 31, 2013 4:28:16 PM org.apache.catalina.core.StandardEngine startInternal
INFO: Starting Servlet Engine: Apache Tomcat/7.0.29
окт 31, 2013 4:28:16 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\apache-tomcat-7.0.29\webapps\docs
окт 31, 2013 4:28:17 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\apache-tomcat-7.0.29\webapps\examples
окт 31, 2013 4:28:17 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\apache-tomcat-7.0.29\webapps\host-manager
окт 31, 2013 4:28:17 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\apache-tomcat-7.0.29\webapps\manager
окт 31, 2013 4:28:18 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\apache-tomcat-7.0.29\webapps\ROOT
окт 31, 2013 4:28:18 PM org.apache.catalina.startup.HostConfig deployDirectory
INFO: Deploying web application directory C:\apache-tomcat-7.0.29\webapps\UC
окт 31, 2013 4:28:19 PM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["http-apr-80"]
окт 31, 2013 4:28:19 PM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["http-nio-443"]
окт 31, 2013 4:28:19 PM org.apache.coyote.AbstractProtocol start
INFO: Starting ProtocolHandler ["ajp-apr-8009"]
окт 31, 2013 4:28:19 PM org.apache.catalina.startup.Catalina start
INFO: Server startup in 2302 ms
окт 31, 2013 4:28:15 PM ru.CryptoPro.ssl.e <init>
FINE: Trusted certificates: empty set.
окт 31, 2013 4:28:15 PM ru.CryptoPro.ssl.e a
FINE:
%% adding as trusted certificates %%
окт 31, 2013 4:28:16 PM ru.CryptoPro.ssl.n <init>
FINE: %% adding as private keys %%
окт 31, 2013 4:28:16 PM ru.CryptoPro.ssl.n <init>
FINE:
found key: wwwcert
окт 31, 2013 4:28:16 PM ru.CryptoPro.ssl.n <init>
FINE:
Certificate chain [0] for key:wwwcert
Subject: CN=Тест, O=тест, L=тест, C=RU, EMAILADDRESS=***@***.com (13105e57000000000027)
Valid from Thu Aug 22 10:36:00 GMT+08:00 2013 until Sat Nov 22 10:46:00 GMT+08:00 2014
окт 31, 2013 4:28:16 PM ru.CryptoPro.ssl.SSLContextImpl engineInit
FINE: SSLContext engineInit
При входе на сайт с сервера лог выглядит следующим образом:
окт 31, 2013 4:32:25 PM ru.CryptoPro.ssl.java6.SSLEngineImpl a
INFO: Using SSLEngineImpl.
окт 31, 2013 4:32:25 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
окт 31, 2013 4:32:25 PM ru.CryptoPro.ssl.java6.SSLEngineImpl a
INFO: Using SSLEngineImpl.
окт 31, 2013 4:32:25 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.E <init>
FINE: ClientHello sessionId:{}
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ClientHello, Unknown 3.3; Cipher Suites: [TLS_CIPHER_2001, Unknown 0x0:0x3c, Unknown 0x0:0x2f, Unknown 0x0:0x3d, Unknown 0x0:0x35, Unknown 0x0:0x5, Unknown 0x0:0xa, Unknown 0xc0:0x27, Unknown 0xc0:0x13, Unknown 0xc0:0x14, Unknown 0xc0:0x2b, Unknown 0xc0:0x23, Unknown 0xc0:0x2c, Unknown 0xc0:0x24, Unknown 0xc0:0x9, Unknown 0xc0:0xa, Unknown 0x0:0x40, SSL3_CK_GVO_KB2, Unknown 0x0:0x6a, Unknown 0x0:0x38, Unknown 0x0:0x13, Unknown 0x0:0x4]; Compression Methods: 0
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.n a
FINE: %% getting aliases for Server
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.n a
FINE: %% matching alias: wwwcert
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.E <init>
FINE: ClientHello sessionId:{}
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ClientHello, Unknown 3.3; Cipher Suites: [TLS_CIPHER_2001, Unknown 0x0:0x3c, Unknown 0x0:0x2f, Unknown 0x0:0x3d, Unknown 0x0:0x35, Unknown 0x0:0x5, Unknown 0x0:0xa, Unknown 0xc0:0x27, Unknown 0xc0:0x13, Unknown 0xc0:0x14, Unknown 0xc0:0x2b, Unknown 0xc0:0x23, Unknown 0xc0:0x2c, Unknown 0xc0:0x24, Unknown 0xc0:0x9, Unknown 0xc0:0xa, Unknown 0x0:0x40, SSL3_CK_GVO_KB2, Unknown 0x0:0x6a, Unknown 0x0:0x38, Unknown 0x0:0x13, Unknown 0x0:0x4]; Compression Methods: 0
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.n a
FINE: %% getting aliases for Server
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.n a
FINE: %% matching alias: wwwcert
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Chosen server alias: wwwcert
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Chosen server alias: wwwcert
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHello, TLSv1; Cipher Suite: TLS_CIPHER_2001; Compression Method: 0
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHello, TLSv1; Cipher Suite: TLS_CIPHER_2001; Compression Method: 0
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: Cipher suite: TLS_CIPHER_2001
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: Cipher suite: TLS_CIPHER_2001
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Certificate message:
Subject: CN=Тест, O=тест, L=тест, C=RU, EMAILADDRESS=***@***.com
Valid from Thu Aug 22 10:36:00 GMT+08:00 2013 until Sat Nov 22 10:46:00 GMT+08:00 2014
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHelloDone (empty)
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Certificate message:
Subject: CN=Тест, O=тест, L=тест, C=RU, EMAILADDRESS=***@***.com
Valid from Thu Aug 22 10:36:00 GMT+08:00 2013 until Sat Nov 22 10:46:00 GMT+08:00 2014
окт 31, 2013 4:32:26 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHelloDone (empty)
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: clntEncIV:B8 18 71 28 0C 29 DC 8F
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: clntEncIV:52 9C FD 90 CC F5 E9 D1
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: svrEncIV:FE C4 5E 5F 7D 12 FD 8B
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: svrEncIV:B4 D5 8B 29 7D AA 2F 14
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Finished.
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Finished.
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: %% Finished.
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Cached server session: [Session-1, TLS_CIPHER_2001]
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: %% Finished.
окт 31, 2013 4:32:28 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Cached server session: [Session-2, TLS_CIPHER_2001]
окт 31, 2013 4:32:32 PM ru.CryptoPro.ssl.java6.SSLEngineImpl closeOutbound
FINE: http-nio-443-exec-9, called closeOutbound()
окт 31, 2013 4:32:32 PM ru.CryptoPro.ssl.java6.SSLEngineImpl h
FINE: http-nio-443-exec-9, closeOutboundInternal()
окт 31, 2013 4:32:33 PM ru.CryptoPro.ssl.java6.SSLEngineImpl closeOutbound
FINE: http-nio-443-exec-10, called closeOutbound()
окт 31, 2013 4:32:33 PM ru.CryptoPro.ssl.java6.SSLEngineImpl h
FINE: http-nio-443-exec-10, closeOutboundInternal()
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl a
INFO: Using SSLEngineImpl.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl a
INFO: Using SSLEngineImpl.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.E <init>
FINE: ClientHello sessionId:{82, 114, 21, 154, 146, 50, 22, 233, 221, 32, 127, 190, 255, 170, 180, 83, 73, 56, 112, 127, 0, 42, 71, 183, 174, 213, 242, 103, 192, 175, 51, 146}
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ClientHello, TLSv1; Cipher Suites: [TLS_CIPHER_2001, SSL3_CK_GVO_KB2, SSL3_CK_GVO]; Compression Methods: 0
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.E <init>
FINE: ClientHello sessionId:{82, 114, 21, 154, 146, 50, 22, 233, 221, 32, 127, 190, 255, 170, 180, 83, 73, 56, 112, 127, 0, 42, 71, 183, 174, 213, 242, 103, 192, 175, 51, 146}
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Resuming [Session-1, TLS_CIPHER_2001]
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ClientHello, TLSv1; Cipher Suites: [TLS_CIPHER_2001, SSL3_CK_GVO_KB2, SSL3_CK_GVO]; Compression Methods: 0
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHello, TLSv1; Cipher Suite: TLS_CIPHER_2001; Compression Method: 0
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.n a
FINE: %% getting aliases for Server
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: Cipher suite: TLS_CIPHER_2001
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.n a
FINE: %% matching alias: wwwcert
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Chosen server alias: wwwcert
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHello, TLSv1; Cipher Suite: TLS_CIPHER_2001; Compression Method: 0
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: Cipher suite: TLS_CIPHER_2001
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Certificate message:
Subject: CN=Тест, O=тест, L=тест, C=RU, EMAILADDRESS=***@***.com
Valid from Thu Aug 22 10:36:00 GMT+08:00 2013 until Sat Nov 22 10:46:00 GMT+08:00 2014
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHelloDone (empty)
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: clntEncIV:C7 00 2C AE CA 42 A7 0C
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: svrEncIV:6F 5A A4 BD EE 59 EA FB
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: clntEncIV:C1 8B 41 85 8B A4 3B 3E
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: svrEncIV:13 48 34 FE 35 11 BF 9C
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: %% Finished.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Finished.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: %% Finished.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Cached server session: [Session-3, TLS_CIPHER_2001]
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl closeOutbound
FINE: http-nio-443-exec-19, called closeOutbound()
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl h
FINE: http-nio-443-exec-19, closeOutboundInternal()
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Finished.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl closeOutbound
FINE: http-nio-443-exec-21, called closeOutbound()
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl h
FINE: http-nio-443-exec-21, closeOutboundInternal()
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl a
INFO: Using SSLEngineImpl.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl a
INFO: Using SSLEngineImpl.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.E <init>
FINE: ClientHello sessionId:{82, 114, 21, 168, 105, 80, 33, 5, 173, 22, 66, 57, 27, 36, 202, 116, 230, 116, 121, 226, 106, 141, 108, 182, 186, 54, 1, 181, 85, 117, 225, 186}
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ClientHello, TLSv1; Cipher Suites: [TLS_CIPHER_2001, SSL3_CK_GVO_KB2, SSL3_CK_GVO]; Compression Methods: 0
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Resuming [Session-3, TLS_CIPHER_2001]
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHello, TLSv1; Cipher Suite: TLS_CIPHER_2001; Compression Method: 0
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: Cipher suite: TLS_CIPHER_2001
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.E <init>
FINE: ClientHello sessionId:{82, 114, 21, 168, 105, 80, 33, 5, 173, 22, 66, 57, 27, 36, 202, 116, 230, 116, 121, 226, 106, 141, 108, 182, 186, 54, 1, 181, 85, 117, 225, 186}
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ClientHello, TLSv1; Cipher Suites: [TLS_CIPHER_2001, SSL3_CK_GVO_KB2, SSL3_CK_GVO]; Compression Methods: 0
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.n a
FINE: %% getting aliases for Server
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.n a
FINE: %% matching alias: wwwcert
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Chosen server alias: wwwcert
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHello, TLSv1; Cipher Suite: TLS_CIPHER_2001; Compression Method: 0
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: Cipher suite: TLS_CIPHER_2001
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Certificate message:
Subject: CN=Тест, O=тест, L=тест, C=RU, EMAILADDRESS=***@***.com Valid from Thu Aug 22 10:36:00 GMT+08:00 2013 until Sat Nov 22 10:46:00 GMT+08:00 2014
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHelloDone (empty)
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: clntEncIV:C1 53 51 C4 94 17 AA A5
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: svrEncIV:65 5D 7E 9E D6 DC 15 6F
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: %% Finished.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: clntEncIV:3D 98 0E 05 6B 66 5D 78
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Finished.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: svrEncIV:04 5E BD FD 37 FE 6E 40
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl closeOutbound
FINE: http-nio-443-exec-4, called closeOutbound()
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.SSLEngineImpl h
FINE: http-nio-443-exec-4, closeOutboundInternal()
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Finished.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: %% Finished.
окт 31, 2013 4:32:40 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Cached server session: [Session-4, TLS_CIPHER_2001]
окт 31, 2013 4:32:48 PM ru.CryptoPro.ssl.java6.SSLEngineImpl closeOutbound
FINE: http-nio-443-exec-8, called closeOutbound()
окт 31, 2013 4:32:48 PM ru.CryptoPro.ssl.java6.SSLEngineImpl h
FINE: http-nio-443-exec-8, closeOutboundInternal()
Лог при входе на сайт с другой машины:
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.SSLEngineImpl a
INFO: Using SSLEngineImpl.
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.Handshaker a
FINE: Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.E <init>
FINE: ClientHello sessionId:{}
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ClientHello, TLSv1; Cipher Suites: [Unknown 0xc0:0x11, Unknown 0xc0:0x7, Unknown 0xc0:0xc, Unknown 0xc0:0x2, Unknown 0x0:0x5, Unknown 0x0:0x4, Unknown 0x0:0x9a, Unknown 0x0:0x99, Unknown 0x0:0x96, Unknown 0x0:0x15, Unknown 0x0:0x12, Unknown 0x0:0x9, Unknown 0x0:0x14, Unknown 0x0:0x11, Unknown 0x0:0x8, Unknown 0xc0:0x12, Unknown 0xc0:0x8, Unknown 0xc0:0x1c, Unknown 0xc0:0x1b, Unknown 0x0:0x16, Unknown 0x0:0x13, Unknown 0xc0:0xd, Unknown 0xc0:0x3, Unknown 0x0:0xa, Unknown 0x0:0x7, Unknown 0x0:0xff]; Compression Methods: 0
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.n a
FINE: %% getting aliases for Server
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.n a
FINE: %% matching alias: wwwcert
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Chosen server alias: wwwcert
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHello, TLSv1; Cipher Suite: SSL3_CK_GVO; Compression Method: 0
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: Cipher suite: SSL3_CK_GVO
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% Certificate message:
Subject: CN=Тест, O=тест, L=тест, C=RU, EMAILADDRESS=***@***.com
Valid from Thu Aug 22 10:36:00 GMT+08:00 2013 until Sat Nov 22 10:46:00 GMT+08:00 2014
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.ServerHandshaker a
FINE: %% ServerHelloDone (empty)
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.SSLEngineImpl closeOutbound
FINE: http-nio-443-exec-4, called closeOutbound()
окт 31, 2013 4:39:57 PM ru.CryptoPro.ssl.java6.SSLEngineImpl h
FINE: http-nio-443-exec-4, closeOutboundInternal()
На клиентской машине стоит КриптоПро CSP R3 3.6.7491, заходить пытаемся с помощью IE9. При этом csptest выполняется успешно:
C:\Program Files\Crypto Pro\CSP>csptest -tlsc -server **** -port 443
-v -file index.jsp -nocheck
csptest -tlsc -server **** -port 443 -v -file index.jsp -nocheck
12 algorithms supported:
[0] 0x660e
[1] 0x6610
[2] 1.2.840.113549.3.4 (rc4)
[3] 1.2.840.113549.3.7 (3des)
[4] 1.3.14.3.2.7 (des)
[5] 1.2.840.113549.2.5 (md5)
[6] 1.3.14.3.2.26 (sha1)
[7] 1.2.840.113549.1.1.1 (RSA)
[8] 1.2.840.113549.1.9.16.3.5 (ESDH)
[9] 0xae06
[10] 1.2.840.10040.4.1 (DSA)
[11] 0x2203
Cipher strengths: 256..256
Supported protocols: 0x200a0
Protocol version: 3.1
ClientHello: RecordLayer: TLS, Len: 117
Cipher Suites: (00 81) (00 2f) (00 35) (00 05) (00 0a) (c0 13) (c0 14) (c0 09) (
c0 0a) (00 32) (00 38) (00 13) (00 04)
122 bytes of handshake data sent
946 bytes of handshake data received
210 bytes of handshake data sent
6 bytes of handshake data received
25 bytes of handshake data received
Handshake was successful
SECPKG_ATTR_CIPHER_INFO: Proto: 80, Suite: 81 (TLS_GOST_R_3410_01_WITH_28147_CNT
_IMIT)
SECPKG_ATTR_NAMES: E=***@***.com, C=RU, L=тест, O=тест, CN=Тест
SECPKG_ATTR_PACKAGE_INFO# fCapabilities: 0x107B3
SECPKG_ATTR_PACKAGE_INFO# wVersion: 1
SECPKG_ATTR_PACKAGE_INFO# wRPCID: 65535
SECPKG_ATTR_PACKAGE_INFO# cbMaxToken: 16379
SECPKG_ATTR_PACKAGE_INFO# Name: CryptoPro SSP
SECPKG_ATTR_PACKAGE_INFO# Comment: CryptoPro Security Package
Server certificate:
Subject: E=***@***.com, C=RU, L=тест, O=тест, CN=Тест
Valid : 22.08.2013 02:36:00 - 22.11.2014 02:46:00 (UTC)
Issuer : E=uc@****.ru, C=RU, L=Krasnoyarsk, O=****, CN=****
Root CA
PrivKey: 22.08.2013 02:36:00 - 22.11.2014 02:36:00 (UTC)
Protocol: TLS 1.0
Cipher: 0x661e
Cipher strength: 256
Hash: 0x801e
Hash strength: 256
Key exchange: 0xaa25
Key exchange strength: 512
Header: 5, Trailer: 4, MaxMessage: 16379
HTTP request: GET /index.jsp HTTP/1.1
User-Agent: Webclient
Accept:*/*
Host: ****
Connection: close
Sending plaintext: 105 bytes
114 bytes of application data sent
8760 bytes of (encrypted) application data received
2867 bytes of (encrypted) application data received
Decrypted data: 11618 bytes
No data in socket: OK if file is completely downloaded
Reply status: HTTP/1.1 200 OK
Sending Close Notify
11 bytes of handshake data sent
1 connections, 11618 bytes in 1.139 seconds;
Total: SYS: 0,078 sec USR: 0,031 sec UTC: 1,232 sec
[ErrorCode: 0x00000000]
Тестовый сертификат для сервера получен в нашем УЦ работающим на базе «КриптоПро УЦ 1.5». Мы подозреваем, что проблема кроится в этом
Цитата:FINE: %% ClientHello, TLSv1; Cipher Suites: [Unknown 0xc0:0x11, Unknown 0xc0:0x7, Unknown 0xc0:0xc, Unknown 0xc0:0x2, Unknown 0x0:0x5, Unknown 0x0:0x4, Unknown 0x0:0x9a, Unknown 0x0:0x99, Unknown 0x0:0x96, Unknown 0x0:0x15, Unknown 0x0:0x12, Unknown 0x0:0x9, Unknown 0x0:0x14, Unknown 0x0:0x11, Unknown 0x0:0x8, Unknown 0xc0:0x12, Unknown 0xc0:0x8, Unknown 0xc0:0x1c, Unknown 0xc0:0x1b, Unknown 0x0:0x16, Unknown 0x0:0x13, Unknown 0xc0:0xd, Unknown 0xc0:0x3, Unknown 0x0:0xa, Unknown 0x0:0x7, Unknown 0x0:0xff]; Compression Methods: 0
Однако почему так происходит, разобраться не удается.
