[Android Apps and Games] Serkenar:
getSession(): javax.net.ssl.SSLHandshakeException: Could not generate secret

Hi,

I'm working on getting BubbleUPnP server to work on Optware-ng. It works in general (using openjdk8), however I'm facing an issue while testing internet connectivity (verbosity increased with -Djavax.net.debug=ssl:handshake):

*** ServerHelloDone
*** ECDHClientKeyExchange
ECDH Public value: { 4, 8, 118, 124, 227, 2, 234, 180, 151, 201, 2, 75, 37, 148, 12, 182, 149, 100, 93, 250, 82, 232, 208, 235, 37, 39, 43, 100, 0, 48, 113, 253, 155, 182, 193, 91, 162, 77, 191, 67, 61, 220, 159, 3, 166, 112, 73, 108, 126, 238, 40, 187, 59, 172, 99, 193, 187, 24, 93, 242, 230, 193, 28, 27, 1 }
qtp7027138-323, WRITE: TLSv1.2 Handshake, length = 70
qtp7027138-323, handling exception: javax.net.ssl.SSLHandshakeException: Could not generate secret
%% Invalidated: [Session-4, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256]
qtp7027138-323, SEND TLSv1.2 ALERT: fatal, description = handshake_failure
qtp7027138-323, WRITE: TLSv1.2 Alert, length = 2
qtp7027138-323, called closeSocket()
qtp7027138-323, IOException in getSession(): javax.net.ssl.SSLHandshakeException: Could not generate secret
qtp7027138-323, called close()
qtp7027138-323, called closeInternal(true)
qtp7027138-323, called close()
qtp7027138-323, called closeInternal(true)
[qtp7027138-323 (323) ] INFO - 02:00:46.398 - b : IO error from : https://bubblesoftapps.com:58052/connectiontest2: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
*** ServerHelloDone
*** ECDHClientKeyExchange
ECDH Public value: { 4, 207, 50, 248, 181, 90, 63, 239, 92, 143, 143, 134, 169, 140, 6, 113, 147, 70, 216, 8, 118, 213, 46, 7, 75, 100, 43, 147, 200, 104, 233, 164, 244, 11, 145, 232, 179, 243, 73, 236, 107, 73, 226, 213, 32, 118, 60, 244, 115, 5, 158, 114, 63, 65, 161, 144, 31, 229, 67, 78, 75, 201, 129, 117, 154 }
qtp7027138-320, WRITE: TLSv1.2 Handshake, length = 70
qtp7027138-320, handling exception: javax.net.ssl.SSLHandshakeException: Could not generate secret
%% Invalidated: [Session-5, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256]
qtp7027138-320, SEND TLSv1.2 ALERT: fatal, description = handshake_failure
qtp7027138-320, WRITE: TLSv1.2 Alert, length = 2
qtp7027138-320, called closeSocket()
qtp7027138-320, IOException in getSession(): javax.net.ssl.SSLHandshakeException: Could not generate secret
qtp7027138-320, called close()
qtp7027138-320, called closeInternal(true)
qtp7027138-320, called close()
qtp7027138-320, called closeInternal(true)
[qtp7027138-320 (320) ] INFO - 02:00:46.436 - b : IO error from : https://bubblesoftapps.com:58052/connectiontest2: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated

Googling up "javax.net.ssl.SSLHandshakeException: Could not generate secret" error didn't produce anything helpful, so I'd be very thankful if you could take a look.

You can reproduce it on a Linux x86 PC (Optware-ng related commands should be run as root, but only '/opt' and '/tmp' will be affected):

1. Install Optware-ng (it installs to /opt):

# mkdir -p /opt
# wget -O - http://ipkg.nslu2-linux.org/optware-ng/bootstrap/buildroot-i686-bootstrap.sh | sh

2. Install openjdk8:

# /opt/bin/ipkg update
# /opt/bin/ipkg install openjdk8-jre-headless jre-cacerts
# rm -f /opt/lib/jvm/openjdk8/jre/lib/security/cacerts
# ln -s /opt/etc/ssl/jre-cacerts /opt/lib/jvm/openjdk8/jre/lib/security/cacerts

3. From bubbleupnpserver dir (this can be run as a regular user, I think):

$ JAVA_HOME=/opt/lib/jvm/openjdk8/jre sh launch.sh -Djavax.net.debug=ssl:handshake

Then navigate to the web ui to initiate connectivity test.

Thanks in advance,

Alex