作者：邵松华

1 问题描述

集成管理的方案转API，在页面点击测试；报错为：网络请求失败，URL是：https://xx.yy.cn/ierp，原因是：Received fatal alert: protocol_version

现场完整报错日志如下：

网络请求失败，URL是：https://xx.yy.cn/ierp，原因是：Received fatal alert: protocol_version
 
ISC_TASK_WORKER-33/traceId:8671da1991bd9f76/time:1722324241580
 
错误码：REQUEST_SEND_ERROR@CommonError
kd.isc.iscb.util.except.IscBizException: 
 at kd.isc.iscb.util.misc.NetUtil.handleIOException(NetUtil.java:645)
 at kd.isc.iscb.util.misc.NetUtil.getResponseCode(NetUtil.java:584)
 at kd.isc.iscb.util.misc.NetUtil.handleResponse(NetUtil.java:376)
 at kd.isc.iscb.util.misc.NetUtil.innerAccess(NetUtil.java:372)
 at kd.isc.iscb.util.misc.NetUtil.httpAccess(NetUtil.java:350)
 at kd.isc.iscb.util.misc.NetUtil.httpGet(NetUtil.java:298)
 at kd.isc.iscb.util.script.misc.HttpGet.call(HttpGet.java:38)
 at kd.isc.iscb.util.script.statement.Invocation.call(Invocation.java:67)
 at kd.isc.iscb.util.script.statement.Invocation.eval(Invocation.java:48)
 at kd.isc.iscb.util.script.Util.eval(Util.java:116)
 at kd.isc.iscb.util.script.feature.op.store.Assign$MultiAssign.eval(Assign.java:78)
 at kd.isc.iscb.util.script.Util.eval(Util.java:116)
 at kd.isc.iscb.util.script.statement.Block.eval(Block.java:43)
 at kd.isc.iscb.util.script.statement.Block.eval(Block.java:36)
 at kd.isc.iscb.util.script.Util.eval(Util.java:116)
 at kd.isc.iscb.util.script.parser.Program.eval(Program.java:71)
 at kd.isc.iscb.util.script.Script.eval(Script.java:281)
 at kd.isc.iscb.util.script.Script.eval(Script.java:269)
 at kd.isc.iscb.util.script.Script.eval(Script.java:257)
 at kd.isc.iscb.util.flow.core.plugin.ext.ScriptProxy.invoke(ScriptProxy.java:35)
 at kd.isc.iscb.util.flow.core.plugin.ext.ScriptApplication.invoke(ScriptApplication.java:29)
 at kd.isc.iscb.platform.core.sf.runtime.n.ScriptProxyApplication.invoke(ScriptProxyApplication.java:42)
 at kd.isc.iscb.util.flow.core.i.c.app.InvokeApplication.invoke(InvokeApplication.java:34)
 at kd.isc.iscb.util.flow.core.i.runtime.ExecutionImpl.execute(ExecutionImpl.java:568)
 at kd.isc.iscb.util.flow.core.i.runtime.ControllerImpl.execute(ControllerImpl.java:50)
 at kd.isc.iscb.util.flow.core.i.runtime.ControllerImpl.execute(ControllerImpl.java:31)
 at kd.isc.iscb.util.flow.core.i.runtime.ControllerImpl.execute(ControllerImpl.java:11)
 at kd.isc.iscb.util.flow.core.i.runtime.RuntimeImpl.resume(RuntimeImpl.java:539)
 at kd.isc.iscb.platform.core.sf.runtime.ProcessExecuteJob.doJob(ProcessExecuteJob.java:22)
 at kd.isc.iscb.platform.core.sf.runtime.AbstractProcessJob$1.run(AbstractProcessJob.java:171)
 at kd.isc.iscb.util.trace.TraceTask.invoke(TraceTask.java:24)
 at kd.isc.iscb.util.trace.TraceManager.run(TraceManager.java:84)
 at kd.isc.iscb.platform.core.trace.TraceStack.run(TraceStack.java:155)
 at kd.isc.iscb.platform.core.trace.TraceStack.run(TraceStack.java:122)
 at kd.isc.iscb.platform.core.sf.runtime.AbstractProcessJob.executeServiceFlowJob(AbstractProcessJob.java:164)
 at kd.isc.iscb.platform.core.sf.runtime.AbstractProcessJob.runServiceFlow(AbstractProcessJob.java:151)
 at kd.isc.iscb.platform.core.sf.runtime.AbstractProcessJob.run(AbstractProcessJob.java:98)
 at kd.isc.iscb.platform.core.job.Job.runX(Job.java:72)
 at kd.isc.iscb.platform.core.job.JobRunner.run(JobRunner.java:76)
 at kd.isc.iscb.platform.core.job.JobRunner.innerExecute(JobRunner.java:66)
 at kd.isc.iscb.platform.core.job.JobRunner.access$000(JobRunner.java:21)
 at kd.isc.iscb.platform.core.job.JobRunner$1.run(JobRunner.java:57)
 at kd.isc.iscb.util.trace.TraceTask.invoke(TraceTask.java:24)
 at kd.isc.iscb.util.trace.TraceManager.trace(TraceManager.java:24)
 at kd.isc.iscb.platform.core.trace.TraceStack.traceJob(TraceStack.java:63)
 at kd.isc.iscb.platform.core.job.JobRunner.doJob(JobRunner.java:54)
 at kd.isc.iscb.platform.core.job.AbstractJobProxy.run(AbstractJobProxy.java:45)
 at kd.isc.iscb.platform.core.task.TaskWorker.innerExecute(TaskWorker.java:161)
 at kd.isc.iscb.platform.core.task.TaskWorker.execute(TaskWorker.java:142)
 at kd.isc.iscb.platform.core.task.TaskWorker.access$400(TaskWorker.java:35)
 at kd.isc.iscb.platform.core.task.TaskWorker$Worker.executeTask(TaskWorker.java:201)
 at kd.isc.iscb.platform.core.task.TaskWorker$Worker.run(TaskWorker.java:182)
 at kd.bos.threads.impl.ThreadPoolImpl.lambda$execute$0(ThreadPoolImpl.java:57)
 at kd.bos.threads.impl.RequestContextRunnable.run(RequestContextRunnable.java:59)
 at kd.bos.thread.ThreadLifeCycleManager$RunnableWrap.run(ThreadLifeCycleManager.java:267)
 at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
 at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
 at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLException: Received fatal alert: protocol_version
 at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
 at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
 at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:2020)
 at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1127)
 at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1367)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1395)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1379)
 at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
 at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
 at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1564)
 at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1492)
 at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
 at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:347)
 at kd.isc.iscb.util.misc.NetUtil.getResponseCode(NetUtil.java:582)
 ... 56 more

2 原因分析（可选）

（1）这个错误信息表明客户端和服务器之间在SSL/TLS握手过程中遇到了不兼容的协议版本问题。

（2）从集成云服务器实例列表，集成管理的容器地址：172.20.14.XX

（3）进入集成云的容器172.20.14.XX里面（有多个容器时，每个容器进入后分别执执行） 执行下面命令进行抓包

tcpdump "host 10.129.xx.88" -w ./curious.pcap

（4）集成管理的方案转API测试页面进行点击测试重现问题后，获取抓包文件curious.pcap

（5）使用“Wireshark 网络分析器”进行分析；发现集成云容器使用的TLSv1;正常应该为：TLSv1.2

3 解决方法

(1) 进入苍穹的运维管理页面—服务管理；找到集成云容器，点击“编辑”

(2) 打开“服务详情”—在页签“更新升级”的JVM_OPTS或者“文本编辑”进行配置

(3) jvm指定TLS版本，以“文本编辑”为例：

添加参数：-Dhttps.protocols=TLSv1.2

(4) 再次测试“集成方案转API”测试通过。

常见集成网络问题与解决方案，请参考帖子：

https://vip.kingdee.com/article/449659230484898048