Re: [Quickfixj-users] Help regarding enabling TLS1.2 between QuickFixJ Server and Client

[Colin D. <co...@ma...>]

Assuming you're using Java8, check this:

https://stackoverflow.com/questions/38205947/sslhandshakeexception-no-appropriate-protocol

On 3/10/20 8:28 AM, Walesa wrote:
> QuickFIX/J Documentation: http://www.quickfixj.org/documentation/
> QuickFIX/J Support: http://www.quickfixj.org/support/
>
>
>
> Hi,
> Am trying to establish connection between QuickFixJServer (Executor 
> from examples) and Banzai Client.
> I get the following exception:
>
> <20200310-14:44:15, FIX.4.4:BANZAI->EXEC, event> (Pending connection 
> not established after 2007 ms.)
> Mar 10, 2020 2:44:15 PM org.apache.mina.util.DefaultExceptionMonitor 
> exceptionCaught
> WARNING: Unexpected exception.
> org.apache.mina.core.filterchain.IoFilterLifeCycleException: 
> onPostAdd(): SslFilter:SSLFilter in (0x00000002: nio socket, client, 
> /172.20.6.65:57244 <http://172.20.6.65:57244/> => /172.20.6.64:9877 
> <http://172.20.6.64:9877/>)
> at 
> org.apache.mina.core.filterchain.DefaultIoFilterChain.register(DefaultIoFilterChain.java:476)
> at 
> org.apache.mina.core.filterchain.DefaultIoFilterChain.addLast(DefaultIoFilterChain.java:234)
> at 
> org.apache.mina.core.filterchain.DefaultIoFilterChainBuilder.buildFilterChain(DefaultIoFilterChainBuilder.java:553)
> at 
> quickfix.mina.CompositeIoFilterChainBuilder.buildFilterChain(CompositeIoFilterChainBuilder.java:42)
> at 
> org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.addNow(AbstractPollingIoProcessor.java:832)
> at 
> org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.handleNewSessions(AbstractPollingIoProcessor.java:752)
> at 
> org.apache.mina.core.polling.AbstractPollingIoProcessor$Processor.run(AbstractPollingIoProcessor.java:652)
> at 
> org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:64)
> at 
> java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
> at 
> java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
> at java.lang.Thread.run(Thread.java:748)
> Caused by: javax.net.ssl.SSLHandshakeException: No appropriate 
> protocol (protocol is disabled or cipher suites are inappropriate)
>
> Configuration:
>
> https://www.quickfixj.org/usermanual/2.0.0/usage/secure_communications.html 
>
>
> After reading above,
> Acceptor config is as :
> [default]
> ....
> SocketConnectProtocol=SOCKET
> # SSL properties
> SocketUseSSL=Y
> SocketKeyStore=<Keystore location created with `keytool -genkeypair 
> -dname "cn=tlsagentServer, ou=Eng, o=Corvil, c=IRE" -keystore 
> tlsagentServer`>
> SocketKeyStorePassword=<password>
> CipherSuites=TLS_RSA_WITH_AES_128_CBC_SHA
> EnabledProtocols=TLSv1.2
> NeedClientAuth=Y
>
> Start the server with
> java 
> -Djava.security.properties=/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/java.security 
> -jar quickfixj-examples-executor-2.2.0-SNAPSHOT-standalone.jar 
> classes/quickfix/examples/executor/executor.cfg
>
> Initiator Config is as:
> [default]
> SocketConnectProtocol=SOCKET
> SocketConnectHost=<ServerIP>
> LogonTimeout=30
> LogoutTimeout=30
>
> # SSL properties
> SocketUseSSL=Y
> SocketKeyStore= <Keystore location created with `keytool -genkeypair 
> -dname "cn=tlsagentServer, ou=Eng, o=Corvil, c=IRE" -keystore 
> tlsagentClient`>
> SocketKeyStorePassword=<password>
> #CipherSuites=TLS_DHE_RSA_WITH_AES_128_CBC_SHA,TLS_DHE_RSA_WITH_AES_256_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA,TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
> CipherSuites=TLS_RSA_WITH_AES_128_CBC_SHA
> #CipherSuites=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
> EnabledProtocols=TLSv1.2
>
> Start the Banzai client with
> java 
> -Djava.security.properties=/usr/lib/jvm/java-8-openjdk-amd64/jre/lib/security/java.security 
> -jar quickfixj-examples-banzai-2.2.0-SNAPSHOT-standalone.jar 
> classes/quickfix/examples/banzai/banzai.cfg
>
> Env:
>
>   * Ubuntu Linux (64-bit)
>  *
>
> Any help would be greatly appreciated.
>
> Regards
> Walesa.
>
>
> _______________________________________________
> Quickfixj-users mailing list
> Qui...@li...
> https://lists.sourceforge.net/lists/listinfo/quickfixj-users

-- 
Colin DuPlantis
Chief Architect, Marketcetera
Download, Run, Trade
888.868.4884
https://www.marketcetera.com