Received fatal alert: handshake_failure

[TMain-Tomi]

Dear @phax,

I meet a SSLHandshakeException when I use AS4ClientSentMessage to send a message. May you give me some advices?
My code:

String charsetStr = FileUtil.detectCharset(sourceFile)
        Charset charset = Charset.forName(charsetStr)
        WSS4JAttachment wss4JAttachment = WSS4JAttachment.createOutgoingFileAttachment(sourceFile, 'bifrost-' + UUID.randomUUID().toString(), sourceFile.name, CMimeType.TEXT_PLAIN, null, charset, as4ResourceHelper)
        clientUserMessage.addAttachment(wss4JAttachment)
//                            clientUserMessage.addAttachment( sourceFile, CMimeType.TEXT_PLAIN, null)
        clientUserMessage = BaseDataPhase4.setKeyStore(clientUserMessage, as4Partner)
        String digest = 'sha-256'
        if (as4Partner.sign && as4Partner.sign.contains('384')) {
            digest = 'sha-384'
        } else if (as4Partner.sign && as4Partner.sign.contains('512')) {
            digest = 'sha-512'
        }
        clientUserMessage.signingParams().setAlgorithmSign(ECryptoAlgorithmSign.getFromIDOrDefault(as4Partner.sign, ECryptoAlgorithmSign.SIGN_ALGORITHM_DEFAULT))
                .setAlgorithmSignDigest(ECryptoAlgorithmSignDigest.getFromIDOrDefault(digest, ECryptoAlgorithmSignDigest.SIGN_DIGEST_ALGORITHM_DEFAULT));
        clientUserMessage.cryptParams().setAlgorithmCrypt(ECryptoAlgorithmCrypt.getFromIDOrDefault(as4Partner.encrypt, ECryptoAlgorithmCrypt.ENCRPYTION_ALGORITHM_DEFAULT))
        ResponseHandlerMicroDom responseHandlerMicroDom = new ResponseHandlerMicroDom()
        IAS4OutgoingDumper dumper = AS4DumpManager.getOutgoingDumper()
        AS4ClientSentMessage as4ClientSentMessage = clientUserMessage.sendMessageWithRetries(as4Partner.protocolAddress, responseHandlerMicroDom, null, dumper, null);

And I have set the certificate to system property:

    System.setProperty("javax.net.ssl.keyStore", jksPath.toString());
    System.setProperty("javax.net.ssl.keyStorePassword", propertiesConfig.keyStorePwd);
    System.setProperty("javax.net.ssl.trustStore", jksPath.toString());
    System.setProperty("javax.net.ssl.trustStorePassword", propertiesConfig.keyStorePwd);

error detail:

2024-04-23T08:33:16.455384374Z Exception in thread "pool-3-thread-15" javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
2024-04-23T08:33:16.455610214Z 	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
2024-04-23T08:33:16.455621650Z 	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:117)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:365)
2024-04-23T08:33:16.455638406Z 	at java.base/sun.security.ssl.Alert$AlertConsumer.consume(Alert.java:293)
2024-04-23T08:33:16.455642508Z 	at java.base/sun.security.ssl.TransportContext.dispatch(TransportContext.java:204)
	at java.base/sun.security.ssl.SSLTransport.decode(SSLTransport.java:172)
2024-04-23T08:33:16.455649001Z 	at java.base/sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1510)
2024-04-23T08:33:16.455658391Z 	at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1425)
	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:455)
2024-04-23T08:33:16.455665364Z 	at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:426)
2024-04-23T08:33:16.455668569Z 	at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.executeHandshake(SSLConnectionSocketFactory.java:303)
2024-04-23T08:33:16.455671885Z 	at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:275)
	at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:251)
2024-04-23T08:33:16.455678454Z 	at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:181)
	at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:447)
2024-04-23T08:33:16.455689656Z 	at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:162)
2024-04-23T08:33:16.455701006Z 	at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:172)
2024-04-23T08:33:16.455704598Z 	at org.apache.hc.client5.http.impl.classic.ConnectExec.execute(ConnectExec.java:142)
2024-04-23T08:33:16.455707846Z 	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
2024-04-23T08:33:16.455744512Z 	at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute(ProtocolExec.java:192)
2024-04-23T08:33:16.455763864Z 	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
	at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute(HttpRequestRetryExec.java:96)
2024-04-23T08:33:16.456214141Z 	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
2024-04-23T08:33:16.456219503Z 	at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute(ContentCompressionExec.java:152)
2024-04-23T08:33:16.456222893Z 	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
2024-04-23T08:33:16.456226130Z 	at org.apache.hc.client5.http.impl.classic.RedirectExec.execute(RedirectExec.java:115)
2024-04-23T08:33:16.456229500Z 	at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
	at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:170)
2024-04-23T08:33:16.456240818Z 	at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:245)
2024-04-23T08:33:16.456244085Z 	at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:188)
	at com.helger.httpclient.HttpClientManager.execute(HttpClientManager.java:137)
2024-04-23T08:33:16.456250690Z 	at com.helger.httpclient.HttpClientManager.execute(HttpClientManager.java:102)
2024-04-23T08:33:16.456253878Z 	at com.helger.phase4.http.BasicHttpPoster.sendGenericMessage(BasicHttpPoster.java:201)
2024-04-23T08:33:16.456257078Z 	at com.helger.phase4.http.BasicHttpPoster.sendGenericMessageWithRetries(BasicHttpPoster.java:384)
	at com.helger.phase4.client.AbstractAS4Client.sendMessageWithRetries(AbstractAS4Client.java:484)
2024-04-23T08:33:16.456263617Z 	at org.codehaus.groovy.vmplugin.v8.IndyInterface.fromCache(IndyInterface.java:321)
2024-04-23T08:33:16.456266811Z 	at com.cargosmart.as4.service.AS4SenderHandler.handle(AS4SenderHandler.groovy:46)
	at org.codehaus.groovy.vmplugin.v8.IndyInterface.fromCache(IndyInterface.java:321)
2024-04-23T08:33:16.456273278Z 	at com.cargosmart.as4.schedule.LocalThreadTaskForFileSend.run(LocalThreadTaskForFileSend.groovy:53)
	at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1136)
2024-04-23T08:33:16.456279758Z 	at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:635)
2024-04-23T08:33:16.456282978Z 	at java.base/java.lang.Thread.run(Thread.java:833)
2024-04-23T16:34:09.662+08:00  INFO 12 --- [xecutorLoop-4-1] i.l.core.protocol.ConnectionWatchdog     : Reconnecting, last destination was /10.220.17.11:6380

Best Regards,
Tomi Lin

[phax]

Hi Tomi Lin,
Thanks for reaching out to me. So from your code snippet I assume you don't use it for Peppol but a different way of AS4 exchange.

Your problem is in the HTTP TLS handshake, so no issues with signing or encryption. Do you have some specific requirements on the TLS certificates (like specific ECDSA curves)?

To customize the TLS certificate try the following - the main focus is on the SSLContext:

javax.net.ssl.SSLContext sslContext = SSLContext.getInstance ("TLS");
// fill the next call correctly
sslContext.init (keyManagers, trustManagers, null);
HttpClientSettings httpClientSettings = new HttpClientSettings ();
httpClientSettings.setSSLContext (sslContext);
// further customize http client settings
clientUserMessage.getHttpPoster ().setHttpClientFactory (new HttpClientFactory (httpClientSettings));
// Send message now

hth, Philip