SSL handshake - java.security.InvalidAlgorithmParameterException issue
Need your advice for a java problem.
Currently we have an issue while accessing the web service using java code.
Our vendor is using SSL - RSA 2048 bits (SHA256withRSA) with DH (Diffie–Hellman algorithm) prime value greater than 1024 for SSL.
We have java version 1.6.0.10 in production.
When we are executing the code, we are getting error –
Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)
... 6 more
Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)
at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)
at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100) ... 13 more
This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495
In above links, I found below statement –
CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE
implementation, which doesn't impose this restriction, or resorting to
the BigNumber API directly.
We cannot upgrade to latest java version. Is there anything we can implement to resolve this SSL handshake issue?
Do we need server side changes for bouncycastle implementation? Or we can use in client side only?
Any advice on solving this issue is highly appreciated.
java ssl java-6
edited Nov 21 '18 at 13:03
lospejos
1,41321426
asked Nov 21 '18 at 12:09
Nachiket Bapat
261
add a comment |
Need your advice for a java problem.
Currently we have an issue while accessing the web service using java code.
Our vendor is using SSL - RSA 2048 bits (SHA256withRSA) with DH (Diffie–Hellman algorithm) prime value greater than 1024 for SSL.
We have java version 1.6.0.10 in production.
When we are executing the code, we are getting error –
Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)
... 6 more
Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)
at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)
at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100) ... 13 more
This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495
In above links, I found below statement –
CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE
implementation, which doesn't impose this restriction, or resorting to
the BigNumber API directly.
We cannot upgrade to latest java version. Is there anything we can implement to resolve this SSL handshake issue?
Do we need server side changes for bouncycastle implementation? Or we can use in client side only?
Any advice on solving this issue is highly appreciated.
java ssl java-6
edited Nov 21 '18 at 13:03
lospejos
1,41321426
asked Nov 21 '18 at 12:09
Nachiket Bapat
261
Update your Java 6 to version 6u171 or later (no need to upgrade).
– rustyx
Nov 21 '18 at 13:07
add a comment |
Need your advice for a java problem.
Currently we have an issue while accessing the web service using java code.
Our vendor is using SSL - RSA 2048 bits (SHA256withRSA) with DH (Diffie–Hellman algorithm) prime value greater than 1024 for SSL.
We have java version 1.6.0.10 in production.
When we are executing the code, we are getting error –
Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)
... 6 more
Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)
at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)
at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100) ... 13 more
This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495
In above links, I found below statement –
CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE
implementation, which doesn't impose this restriction, or resorting to
the BigNumber API directly.
We cannot upgrade to latest java version. Is there anything we can implement to resolve this SSL handshake issue?
Do we need server side changes for bouncycastle implementation? Or we can use in client side only?
Any advice on solving this issue is highly appreciated.
java ssl java-6
edited Nov 21 '18 at 13:03
lospejos
1,41321426
asked Nov 21 '18 at 12:09
Nachiket Bapat
261
Need your advice for a java problem.
Currently we have an issue while accessing the web service using java code.
Our vendor is using SSL - RSA 2048 bits (SHA256withRSA) with DH (Diffie–Hellman algorithm) prime value greater than 1024 for SSL.
We have java version 1.6.0.10 in production.
When we are executing the code, we are getting error –
Caused by: java.lang.RuntimeException: Could not generate DH keypair at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:106)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:556)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:183)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1165)
... 6 more
Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive) at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)
at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)
at com.sun.net.ssl.internal.ssl.DHCrypt.<init>(DHCrypt.java:100) ... 13 more
This is known bug/limitation of java and its already fixed in v7 and onwards but it still exists in ‘1.6.0.10’
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=7044060
https://bugs.java.com/bugdatabase/view_bug.do?bug_id=6521495
In above links, I found below statement –
CUSTOMER SUBMITTED WORKAROUND : Using BouncyCastle's JCE
implementation, which doesn't impose this restriction, or resorting to
the BigNumber API directly.
We cannot upgrade to latest java version. Is there anything we can implement to resolve this SSL handshake issue?
Do we need server side changes for bouncycastle implementation? Or we can use in client side only?
Any advice on solving this issue is highly appreciated.
java ssl java-6
java ssl java-6
edited Nov 21 '18 at 13:03
lospejos
1,41321426
asked Nov 21 '18 at 12:09
Nachiket Bapat
261
edited Nov 21 '18 at 13:03
lospejos
1,41321426
asked Nov 21 '18 at 12:09
Nachiket Bapat
261
edited Nov 21 '18 at 13:03
lospejos
1,41321426
edited Nov 21 '18 at 13:03
lospejos
1,41321426
edited Nov 21 '18 at 13:03
lospejos
1,41321426
1,41321426
asked Nov 21 '18 at 12:09
Nachiket Bapat
261
asked Nov 21 '18 at 12:09
Nachiket Bapat
261
asked Nov 21 '18 at 12:09
Nachiket Bapat
261
261
Update your Java 6 to version 6u171 or later (no need to upgrade).
– rustyx
Nov 21 '18 at 13:07
add a comment |
Update your Java 6 to version 6u171 or later (no need to upgrade).
– rustyx
Nov 21 '18 at 13:07
Update your Java 6 to version 6u171 or later (no need to upgrade).
– rustyx
Nov 21 '18 at 13:07
Update your Java 6 to version 6u171 or later (no need to upgrade).
– rustyx
Nov 21 '18 at 13:07
add a comment |
1 Answer
1
active
oldest
votes
The jar for BouncyCastle's JCE implementation can be downloaded in LATEST JAVA RELEASES of Bouncy Castle Crypto package.
And the configuration required can be found in To configure a JCE Provider.
After the configuration is done. Print the security providers information like the following code.
Provider providers = Security.getProviders();
for (int i = 0; i != providers.length; i++)
{
System.out.println(providers[i].getInfo());
}
See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)
answered Nov 21 '18 at 14:15
samabcde
1,0251412
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53411739%2fssl-handshake-java-security-invalidalgorithmparameterexception-issue%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The jar for BouncyCastle's JCE implementation can be downloaded in LATEST JAVA RELEASES of Bouncy Castle Crypto package.
And the configuration required can be found in To configure a JCE Provider.
After the configuration is done. Print the security providers information like the following code.
Provider providers = Security.getProviders();
for (int i = 0; i != providers.length; i++)
{
System.out.println(providers[i].getInfo());
}
See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)
answered Nov 21 '18 at 14:15
samabcde
1,0251412
add a comment |
The jar for BouncyCastle's JCE implementation can be downloaded in LATEST JAVA RELEASES of Bouncy Castle Crypto package.
And the configuration required can be found in To configure a JCE Provider.
After the configuration is done. Print the security providers information like the following code.
Provider providers = Security.getProviders();
for (int i = 0; i != providers.length; i++)
{
System.out.println(providers[i].getInfo());
}
See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)
answered Nov 21 '18 at 14:15
samabcde
1,0251412
add a comment |
The jar for BouncyCastle's JCE implementation can be downloaded in LATEST JAVA RELEASES of Bouncy Castle Crypto package.
And the configuration required can be found in To configure a JCE Provider.
After the configuration is done. Print the security providers information like the following code.
Provider providers = Security.getProviders();
for (int i = 0; i != providers.length; i++)
{
System.out.println(providers[i].getInfo());
}
See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)
answered Nov 21 '18 at 14:15
samabcde
1,0251412
The jar for BouncyCastle's JCE implementation can be downloaded in LATEST JAVA RELEASES of Bouncy Castle Crypto package.
And the configuration required can be found in To configure a JCE Provider.
After the configuration is done. Print the security providers information like the following code.
Provider providers = Security.getProviders();
for (int i = 0; i != providers.length; i++)
{
System.out.println(providers[i].getInfo());
}
See if "BouncyCastle Security Provider v1.60" is shown.(Suppose you are downloading version 1.6)
answered Nov 21 '18 at 14:15
samabcde
1,0251412
answered Nov 21 '18 at 14:15
samabcde
1,0251412
answered Nov 21 '18 at 14:15
samabcde
1,0251412
answered Nov 21 '18 at 14:15
samabcde
1,0251412
1,0251412
add a comment |
add a comment |
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53411739%2fssl-handshake-java-security-invalidalgorithmparameterexception-issue%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Update your Java 6 to version 6u171 or later (no need to upgrade).
– rustyx
Nov 21 '18 at 13:07