javax.net.ssl.SSLHandshakeException：错误：10000438：SSL 例程：OPENSSL_internal：TLSV1_ALERT_INTERNAL_ERROR答案

【问题标题】：javax.net.ssl.SSLHandshakeException: error:10000438:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERRORjavax.net.ssl.SSLHandshakeException：错误：10000438：SSL 例程：OPENSSL_internal：TLSV1_ALERT_INTERNAL_ERROR
【发布时间】：2021-10-25 00:56:51
【问题描述】：

我无法从本地环境连接到我的 Pulsar 测试集群，但它昨天运行良好。客户端或服务器端没有任何变化。当我尝试从我的应用程序连接时，出现此异常：

2021-08-24T17:07:55,776 [pulsar-io-23-15] WARN  org.apache.pulsar.broker.service.ServerCnx - [/10.16.13.41:23586] Got exception io.netty.handler.codec.DecoderException: javax.net.ssl.SSLHandshakeException: error:10000438:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR
    at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:468)
    at io.netty.handler.codec.ByteToMessageDecoder.channelRead(ByteToMessageDecoder.java:276)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
    at io.netty.channel.AbstractChannelHandlerContext.fireChannelRead(AbstractChannelHandlerContext.java:357)
    at io.netty.channel.DefaultChannelPipeline$HeadContext.channelRead(DefaultChannelPipeline.java:1410)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:379)
    at io.netty.channel.AbstractChannelHandlerContext.invokeChannelRead(AbstractChannelHandlerContext.java:365)
    at io.netty.channel.DefaultChannelPipeline.fireChannelRead(DefaultChannelPipeline.java:919)
    at io.netty.channel.epoll.AbstractEpollStreamChannel$EpollStreamUnsafe.epollInReady(AbstractEpollStreamChannel.java:792)
    at io.netty.channel.epoll.EpollEventLoop.processReady(EpollEventLoop.java:475)
    at io.netty.channel.epoll.EpollEventLoop.run(EpollEventLoop.java:378)
    at io.netty.util.concurrent.SingleThreadEventExecutor$4.run(SingleThreadEventExecutor.java:989)
    at io.netty.util.internal.ThreadExecutorMap$2.run(ThreadExecutorMap.java:74)
    at io.netty.util.concurrent.FastThreadLocalRunnable.run(FastThreadLocalRunnable.java:30)
    at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: error:10000438:SSL routines:OPENSSL_internal:TLSV1_ALERT_INTERNAL_ERROR
    at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.shutdownWithError(ReferenceCountedOpenSslEngine.java:1007)
    at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.sslReadErrorResult(ReferenceCountedOpenSslEngine.java:1271)
    at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1225)
    at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1296)
    at io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1339)
    at io.netty.handler.ssl.SslHandler$SslEngineType$1.unwrap(SslHandler.java:205)
    at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1340)
    at io.netty.handler.ssl.SslHandler.decodeNonJdkCompatible(SslHandler.java:1247)
    at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1284)
    at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:498)
    at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:437)
    ... 15 more```

Restarting the app does not resolve the issue. 
We're using Pulsar token-auth with a pretty vanilla configuration:

     client = PulsarClient.builder().serviceUrl(serviceUrl)
           .tlsTrustCertsFilePath(serverCertificateFilePath.toString())
           .enableTlsHostnameVerification(false)
           .allowTlsInsecureConnection(false)
           .authentication(AuthenticationFactory.token(authToken))
           .build();

The consumer is also pretty standard (though it has a DLQ) and looks like this:

    pulsarClient.newConsumer(Schema.STRING)
                .consumerName(String.format("%s:%s", consumerProperties.getSubscriptionName(), UUID.randomUUID()))
                .topic(consumerProperties.getDeadLetterTopic())
                .subscriptionName(consumerProperties.getSubscriptionName())
                .subscriptionType(SubscriptionType.Shared)
                .messageListener(deadLetterTopicMessageListener)
                .ackTimeout(consumerProperties.getAcknowledgeTimeout(), TimeUnit.SECONDS)
                .subscribe();

We've double-checked that the token and certificates are all correct. 
Also, the broker tlsProtocol includes v1, as follows:

    tlsProtocols=TLSv1.2,TLSv1.1,TLSv1

How do I resolve this issue?

【问题讨论】：

标签： apache-pulsar

【解决方案1】：

我们已经看到一些边缘情况，客户端 VPN 问题会导致此错误消息。一些用户报告说，在重新启动、清除 docker 缓存并重新连接到 VPN 后，此问题得到解决。一位用户报告说它在多次重新启动后消失了，因此最终可能会超时。

【讨论】：