title: Apache httpclient javax.net.ssl.SSLHandshakeException:
body: <p>I am trying to connect to a service with SSLv3 security. </p>
  
  <p>The communication works with curl and browser after providing the following files</p>
  
  <pre><code>1. ca.crt
  2. private.key
  2. client.crt
  </code></pre>
  
  <p>I used all the 3 files to create an ssl keystore  with following cmd </p>
  
  <pre><code>openssl  pkcs12 -export  -in client.crt  -inkey private.key  -CAfile ca.crt  -out sslstore.p12
  </code></pre>
  
  <p>And then used keytool to import it as java truststore</p>
  
  <pre><code>keytool -importkeystore -srckeystore sslstore.p12  -srcstoretype PKCS12  -destkeystore truststore.jks
  </code></pre>
  
  <p>After than I am followed the following link <a href="https://hc.apache.org/httpcomponents-client-ga/httpclient/examples/org/apache/http/examples/client/ClientCustomSSL.java" rel="nofollow">https://hc.apache.org/httpcomponents-client-ga/httpclient/examples/org/apache/http/examples/client/ClientCustomSSL.java</a> 
  to connect to the url. Only changing the protocol from TLSv1 to SSLv3. </p>
  
  <p>I always get javax.net.ssl.SSLHandshakeException: excdption while connecting. </p>
  
  <p>As already mentioned the keys work with curl / browser. </p>
  
  <p><em>EDIT-2</em>
  Changing the code near SSLContexts.custom() </p>
  
  <p>from:</p>
  
  <pre><code>sslcontext = SSLContexts.custom()                        
                      .loadTrustMaterial(keyStore, new TrustSelfSignedStrategy())
                      .build();
  </code></pre>
  
  <p>to:</p>
  
  <pre><code>sslcontext = SSLContexts.custom()
                      .loadKeyMaterial(keyStore, "changeit".toCharArray())
                      .loadTrustMaterial(keyStore, new TrustSelfSignedStrategy())
                      .build();
  </code></pre>
  
  <p>worked. Note that I am using the same keystore.</p>
  
  <p><em>EDIT-1</em>
  Code:</p>
  
  <pre><code>public static void main (String[] args) throws KeyStoreException, FileNotFoundException {
  
  
          KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
  
          InputStream is  = Thread.currentThread().getContextClassLoader().getResourceAsStream("certs/ppro.jks");
  
          try {
              keyStore.load(is,"changeit".toCharArray());
          } catch (IOException | NoSuchAlgorithmException | CertificateException e) {
              e.printStackTrace();
          }
          // Trust own CA and all self-signed certs
          SSLContext sslcontext = null;
          try {
              sslcontext = SSLContexts.custom()
                      .loadTrustMaterial(keyStore, new TrustSelfSignedStrategy())
                      .build();
          } catch (NoSuchAlgorithmException | KeyManagementException e) {
              e.printStackTrace();
          }
          try {
              sslcontext.loadKeyMaterial(keyStore,"changeit".toCharArray());
          } catch (NoSuchAlgorithmException | KeyManagementException e) {
              e.printStackTrace();
          }
          // Allow TLSv1 protocol only
          SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
                  sslcontext,
                  new String[] { "SSLv3" } ,
                  null,
                  SSLConnectionSocketFactory.BROWSER_COMPATIBLE_HOSTNAME_VERIFIER);
  
          try (CloseableHttpClient httpclient = HttpClients.custom()
                  .setSSLSocketFactory(sslsf)
                  .build()) {
              HttpPost httpPost = new HttpPost(URL);
              try {
  
                  CloseableHttpResponse response = httpclient.execute(httpPost);
                  System.out.println(response);
  
              } catch (IOException e) {
                  e.printStackTrace();
              }
          } catch (IOException e) {
              e.printStackTrace();
          }
  
      }
  </code></pre>
  
  <p><em>EDIT-0</em></p>
  
  <p>Here is the stacktrace from java  including some ssl debug info.</p>
  
  <pre><code>*** ClientKeyExchange, RSA PreMasterSecret, SSLv3
  main, WRITE: SSLv3 Handshake, length = 132
  SESSION KEYGEN:
  PreMaster Secret:
  0000: 03 00 E7 89 C2 9D AB 1A   3B 75 85 5B 4E C6 EE 10  ........;u.[N...
  0010: 83 0F 3C 37 74 3C D0 6A   AF 51 D7 EC E2 B9 50 35  ..&lt;7t&lt;.j.Q....P5
  0020: CC 8D 58 93 39 5D B6 4F   BE DB 5A F4 E3 0A BE 42  ..X.9].O..Z....B
  CONNECTION KEYGEN:
  Client Nonce:
  0000: 53 47 9A BD 4B 14 BC AF   B0 2B FB 6C 49 9C E4 53  SG..K....+.lI..S
  0010: 21 F3 53 C8 7F 74 1C 5C   C0 5E 6D 67 18 50 10 4D  !.S..t.\.^mg.P.M
  Server Nonce:
  0000: 53 47 9A BD B2 5C 44 89   92 BE 4B FF F4 F6 60 FE  SG...\D...K...`.
  0010: D6 18 67 96 6A 13 3C 80   9F D2 56 29 1A 60 B4 E4  ..g.j.&lt;...V).`..
  Master Secret:
  0000: E3 E5 11 9F 87 B6 A3 4E   8C 9C F1 20 E9 A5 50 62  .......N... ..Pb
  0010: DD E8 E6 A3 61 FC C0 56   0C 1E A8 29 BC F4 5C 52  ....a..V...)..\R
  0020: DE CE 98 64 0E 57 07 E6   22 24 08 1A 77 8A 97 48  ...d.W.."$..w..H
  Client MAC write Secret:
  0000: 44 98 8B 9C C4 59 C2 4E   21 66 67 6D 96 C4 FE 9C  D....Y.N!fgm....
  0010: 2B 74 AD 61                                        +t.a
  Server MAC write Secret:
  0000: 29 7D 5A F2 71 B6 55 C0   CF BB 82 66 02 03 B1 35  ).Z.q.U....f...5
  0010: 5A 69 83 99                                        Zi..
  Client write key:
  0000: B5 32 F7 7C DC DB 4F B4   00 48 66 A4 B3 C0 7D 6B  .2....O..Hf....k
  Server write key:
  0000: CB 80 F4 76 53 92 6F 87   3B A3 9D B2 A9 6F 40 85  ...vS.o.;....o@.
  Client write IV:
  0000: B7 89 4A FC 43 7A 1B 3C   DD 83 7F CE A1 FC FB BF  ..J.Cz.&lt;........
  Server write IV:
  0000: 84 92 B7 B4 EB 13 B6 77   EF 87 B0 E1 04 41 5C 4D  .......w.....A\M
  main, WRITE: SSLv3 Change Cipher Spec, length = 1
  *** Finished
  verify_data:  { 116, 66, 54, 146, 216, 200, 254, 221, 170, 236, 204, 2, 17, 139, 161, 37, 205, 117, 131, 95, 255, 123, 158, 100, 150, 110, 105, 209, 22, 205, 31, 196, 95, 84, 59, 252 }
  ***
  main, WRITE: SSLv3 Handshake, length = 64
  javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
      at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1959)
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1077)
      at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339)
      at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323)
      at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:275)
      at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:254)
      at org.apache.http.impl.conn.HttpClientConnectionOperator.connect(HttpClientConnectionOperator.java:118)
      at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:314)
      at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:363)
      at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:219)
      at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:195)
      at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:85)
      at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:108)
      at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:186)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82)
      at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:106)
      at com.masterpayment.frontend.gateway.beconnector.GiroGateClient.main(GiroGateClient.java:66)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
      at java.lang.reflect.Method.invoke(Method.java:606)
      at com.intellij.rt.execution.application.AppMain.main(AppMain.java:120)
  main, READ: SSLv3 Alert, length = 2
  main, RECV SSLv3 ALERT:  fatal, handshake_failure
  %% Invalidated:  [Session-1, TLS_RSA_WITH_AES_128_CBC_SHA]
  main, called closeSocket()
  main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
  </code></pre>