title: Handshake failure / no cipher suites in common - SymmetricDS 3.1.5
body: <p>I am upgrading from SymmetricDS (SDS) 2.5.13 to 3.1.5. <strong>I have TLS/HTTPS configured and working as expected under SDS 2.5.13</strong>. However, using the <strong>exact same certificates, keystore/truststore files, and same JDK</strong>, I get the following error under SDS 3.1.5 in the service wrapper log (wrapper.log):</p>
  
  <pre><code>SEND TLSv1 ALERT: fatal, description = handshake_failure  
  WRITE: TLSv1 Alert, length = 2  
  called closeSocket()  
  handling exception: javax.net.ssl.SSLHandshakeException: no cipher suites in common
  </code></pre>
  
  <p>I have a two node configuration with one configured as a registration server (parent node). The child node is configured to push and pull changes. I am using the Sun (Oracle) JDK 7 update 5 with the appropriate JCE Unlimited Strength Jurisdiction Policy Files (to gain access to 256 bit ciphers).</p>
  
  <p>I am running SDS in a standalone configuration as a windows service under Server 2008. Windows firewall is currently off.</p>
  
  <p>I am passing the following TLS-related Java parameters to the service wrapper via the sym_service.conf file:</p>
  
  <pre><code>wrapper.java.additional.6=-Dsym.keystore.file=c:/java-keystore/bfvm01-w2ka.ks
  wrapper.java.additional.7=-Djavax.net.ssl.keyStore=c:/java-keystore/bfvm01-w2ka.ks
  wrapper.java.additional.8=-Djavax.net.ssl.trustStore=c:/java-keystore/bfvm01-w2ka.ks
  wrapper.java.additional.9=-Djavax.net.ssl.keyStorePassword=letmein
  wrapper.java.additional.10=-Djavax.net.ssl.trustStorePassword=letmein
  wrapper.java.additional.11=-Dsun.net.client.defaultReadTimeout=1800000
  wrapper.java.additional.12=-Dsun.net.client.defaultConnectTimeout=1800000
  wrapper.java.additional.13=-Djavax.net.debug=ssl,handshake
  </code></pre>
  
  <p>Note: As is standard practice here for Java apps, we are using the same Java keystore file for both the keystore and the trustore.</p>
  
  <p>This is how the service wrapper is configured to start SDS:</p>
  
  <pre><code>wrapper.app.parameter.1=org.jumpmind.symmetric.SymmetricLauncher
  wrapper.app.parameter.2=--secure-server
  wrapper.app.parameter.3=--secure-port
  wrapper.app.parameter.4=25684
  wrapper.app.parameter.5=--properties
  wrapper.app.parameter.6=../conf/symmetric.properties
  </code></pre>
  
  <p>The entries in sym_node and symmetric.properties are properly configured to use HTTPS (instead of HTTP).</p>
  
  <p>The child SDS node, which initiates communication with the parent reports this error:</p>
  
  <pre><code>WRITE: TLSv1 Handshake, length = 198  
  READ: TLSv1 Alert, length = 2  
  RECV TLSv1 ALERT: fatal, handshake_failure  
  called closeSocket()  
  handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
  </code></pre>
  
  <p>The parent node reports this error:</p>
  
  <pre><code>SEND TLSv1 ALERT: fatal, description = handshake_failure  
  WRITE: TLSv1 Alert, length = 2  
  called closeSocket()  
  handling exception: javax.net.ssl.SSLHandshakeException: no cipher suites in common
  </code></pre>
  
  <p>As I mentioned previously, the same configuration (servers, certificates, keystore/trustore files, JDK) works fine to achieve TLS/HTTPS security under SDS 2.5.13. The only delta is the switch to SDS 3.1.5. If I disable TLS/HTTPS configuration in SDS 3.1.5 and use HTTP instead, the parent and child nodes can communicate with one another.</p>
  
  <p>As a desperate, sanity check, I coded a quick, "Hello World", client server app to create an SSLSocket on my child node machine and send a line of text to the server node machine (using the same TCP port I have been using for SDS). Compiled and ran program using same JDK and same keystore/truststore files. Worked like a champ.</p>
  
  <p>I am totally stumped. Any help would be appreciated.</p>