SSL handshake fails for servers with strong ciphers

[hrj]

For example, navigating to https://clbin.com causes:

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1991)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1104)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1371)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1355)
at com.squareup.okhttp.Connection.upgradeToTls(Connection.java:238)
at com.squareup.okhttp.Connection.connect(Connection.java:153)
at com.squareup.okhttp.Connection.connectAndSetOwner(Connection.java:169)
at com.squareup.okhttp.OkHttpClient$1.connectAndSetOwner(OkHttpClient.java:104)
at com.squareup.okhttp.internal.http.RouteSelector.next(RouteSelector.java:131)
at com.squareup.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:292)
at com.squareup.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:235)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:420)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.getResponse(HttpURLConnectionImpl.java:371)
at com.squareup.okhttp.internal.huc.HttpURLConnectionImpl.getResponseCode(HttpURLConnectionImpl.java:466)
at com.squareup.okhttp.internal.huc.DelegatingHttpsURLConnection.getResponseCode(DelegatingHttpsURLConnection.java:105)
at com.squareup.okhttp.internal.huc.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:25)
at org.lobobrowser.request.RequestEngine.processHandler(RequestEngine.java:769)
at org.lobobrowser.request.RequestEngine.access$1(RequestEngine.java:730)
at org.lobobrowser.request.RequestEngine$RequestHandlerTask.lambda$0(RequestEngine.java:1052)
at org.lobobrowser.request.RequestEngine$RequestHandlerTask$$Lambda$28/1859836341.run(Unknown Source)
at java.security.AccessController.doPrivileged(Native Method)
at org.lobobrowser.request.RequestEngine$RequestHandlerTask.run(RequestEngine.java:1058)
at org.lobobrowser.util.SimpleThreadPool$ThreadRunnable.run(SimpleThreadPool.java:129)
at java.lang.Thread.run(Thread.java:745)

[hrj]

Fails even without okhttp:

javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
    at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1991)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1104)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1371)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1355)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1511)
    at sun.net.www.protocol.http.HttpURLConnection.access$200(HttpURLConnection.java:90)
    at sun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1431)
    at sun.net.www.protocol.http.HttpURLConnection$9.run(HttpURLConnection.java:1429)
    at java.security.AccessController.doPrivileged(Native Method)
    at java.security.AccessController.doPrivileged(AccessController.java:713)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1428)
    at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:338)
    at org.lobobrowser.request.RequestEngine.processHandler(RequestEngine.java:769)
    at org.lobobrowser.request.RequestEngine.access$1(RequestEngine.java:730)
    at org.lobobrowser.request.RequestEngine$RequestHandlerTask.lambda$0(RequestEngine.java:1052)
    at org.lobobrowser.request.RequestEngine$RequestHandlerTask$$Lambda$28/1965438258.run(Unknown Source)
    at java.security.AccessController.doPrivileged(Native Method)
    at org.lobobrowser.request.RequestEngine$RequestHandlerTask.run(RequestEngine.java:1058)
    at org.lobobrowser.util.SimpleThreadPool$ThreadRunnable.run(SimpleThreadPool.java:129)
    at java.lang.Thread.run(Thread.java:745)

[hrj]

Fails with okhttp-2.1.1 as well.

[hrj]

This is due to restrictions in the Oracle JDK (import limits), documented here.

Simple way to reproduce this:

(new java.net.URL("https://clbin.com")).openConnection().getContent()

Running the above on OpenJDK 7 works fine.

[hrj]

We now show an explanation to the user when the SSL handshake exception happens and a link to this wiki page.

[hrj]

There are couple of things we can do on our side:

• Inform users to install the JCE unlimited policy. Done, through the wiki.
• Request JRE vendors to bundle JCE unlimited policy along with the JRE. Done, offline over email.
• Try converting our code base to Java 7. This will help slightly since openjdk builds for version 7 are more easily available (and they don't face this problem). Being addressed in Support Java 7 #12

[hrj]

Updates

1. Looks like Java 8u31 now supports atleast one cipher from clbin.com and hence doesn't fail anymore. (Either that, or clbin.com server has started supporting more ciphers).
2. An unlimited strength policy is available for zulu as well.