This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal


May 9, 2018, 4:26 AM
37 Posts

SSL connection to payment gateway fails with 'handshake_failure'

  • Category: Application Development
  • Platform: Windows
  • Release: 9.0.1
  • Role: Developer
  • Tags: xpages,ssl,java,HttpURLConnection
  • Replies: 4

I am experiencing an issue almost exactly the same as that posted a couple of years ago here:

http://www-10.lotus.com/ldd/ndseforum.nsf/xpTopicThread.xsp?documentId=C1360BAA902999AC85258036006B4F94

 

I have a Java agent that connects to a payment gateway to validate a CC transaction.

Everything seems to work fine when the Java logic is run on my Notes client (9.0.1FP10IF3).

 

I am now migrating the logic to a managed bean on my Domino server (9.0.1FP6).

Whenever the connection is made through the bean, I observe the following error on the server console...

 

HTTP JVM: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

 

I am certain it's because the payment gateway with which I am attempting to communicate has recently upgraded to enforce mandatory TLS 1.2 communications.

However, I'm not sure how to enforce those communications on the Domino server side?

 

I have set the recommended NOTES.INI variables...

DISABLE_SSLV3=1

SSL_DISABLE_TLS_10=1

... and set the 'SSLCipherSpec', but nothing is working.

 

Here is an excerpt from the logic I'm using to test everything out.

The line in red is what triggers the error...

 

URL url = new URL("https://host/endpoint");
HttpURLConnection connection = (HttpURLConnection) url.openConnection();
connection.setRequestMethod("POST");
connection.setAllowUserInteraction(false);
connection.setDoOutput(true);
connection.setDoInput(true);
connection.setUseCaches(false);
connection.setRequestProperty("Content-type", "text/xml");
connection.setRequestProperty("Content-length", Integer.toString(postContent.length()));

DataOutputStream out = new DataOutputStream(connection.getOutputStream());
out.writeBytes(postContent);
out.flush();
out.close();
connection.disconnect();

 

Any advice/assistance would be most appreciated!

May 9, 2018, 1:37 PM
323 Posts
Normally the complexity is on the certificates side.

I don't know exactly what the issue will be, but TLS is using different certificates, too. If the gateway people haven't given you some long list of certificates they'll accept, along with offering to receive your certs for validation by their gateway, then I would make that my next step in complaining to their support line.

May 9, 2018, 2:19 PM
94 Posts
Those notes.ini variables are for the TLS stack in "core", not the Java stack.
You may need to apply an "unrestricted policy file" for the Java that shipped with Domino. A quick web search on that term should tell you exactly what to do.
May 9, 2018, 11:39 PM
37 Posts
You nailed it Shaun!

Holy crap... how did that NOT show up in all my online searches?!

That was exactly what I needed to do, and everything works perfectly now - Thanks so much for your reply!!


This forum is closed to new posts and responses. Individual names altered for privacy purposes. The information contained in this website is provided for informational purposes only and should not be construed as a forum for customer support requests. Any customer support requests should be directed to the official HCL customer support channels below:

HCL Software Customer Support Portal for U.S. Federal Government clients
HCL Software Customer Support Portal