WatsonServices: Unable to find acceptable protocols

[joralemarti]

Hello, I'm testing the Watson Conversation Services:

Using Netbeans, IBM JAVA SDK 1.8, java-sdk-3.5.3-jar-with-dependencies.jar

I got this error when I tried the following:

ConversationService service = new ConversationService("2017_02_03"); 
service.setUsernameAndPassword("XXXXXXXXX", "XXXXXX"); 
MessageRequest newMessage = new MessageRequest.Builder()
  .inputText("This is some sample text")
  .build(); 

MessageResponse newresponse = service.message(
  "XXXXXXXXXXXXXXXXXXXXXXX",
  newMessage)
.execute();

WARNING: Exception on MessageDispatcher: java.lang.RuntimeException: java.net.UnknownServiceException: Unable to find acceptable protocols. isFallback=false, modes=[ConnectionSpec(cipherSuites=[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA], tlsVersions=[TLS_1_2, TLS_1_1, TLS_1_0], supportsTlsExtensions=true), ConnectionSpec(cipherSuites=[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA], tlsVersions=[TLS_1_0], supportsTlsExtensions=true), ConnectionSpec()], supported protocols=[TLSv1] at com.ibm.watson.developer_cloud.service.WatsonService$1.execute(WatsonService.java:182)
Thanks in advance.

[bruceadams]

IBM Java and the Apache Http Client library do not cooperate very well when accessing TLS 1.2 servers.

See: https://issues.apache.org/jira/browse/HTTPCLIENT-1784
and: http://www.ibm.com/support/knowledgecenter/SSYKE2_8.0.0/com.ibm.java.security.component.80.doc/security-component/jsse2Docs/matchsslcontext_tls.html

[germanattanasio]

This is a duplicate of #610

[ShubhamSharmaCSE]

Please can anyone provide me about the details of how to tackle this issue, I have a submission of my final year project this week but this error is not letting us test our project .

Thanks.

[bruceadams]

@ShubhamSharmaCSE The easiest workaround is to use OpenJDK or Oracle Java instead of IBM Java. Can you do that?

[asidd]

Here is an update from a customer who is using Oracle JDK but faces this issue:

We are using Oracle Java JDK.
At runtime – when the application gets pushed to bluemix It uses – IBM JDK

buildpack-v3.8-20170308-1507
ibmjdk-1.8.0_20170215
liberty-17.0.0_1

We are seeing this issue – only when deploying new war file
Existing apps continue to work. Can you let us know what could be issue.

Thanks

[tahir-mehmood]

I am also facing same issue when I try to deploy a modified application. It gives me below error :

2017-03-22T15:20:23.06+0500 [APP/0] OUT 10:20:23.040 [Thread-20] ERROR com.ibm.watson.apis.conversation_enhanced.listener.SetupThread - Error ini
tializing Collectionjava.net.UnknownServiceException: Unable to find acceptable protocols. isFallback=false, modes=[ConnectionSpec(cipherSuites=[TLS_E
CDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA,
TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DH
E_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA
], tlsVersions=[TLS_1_2, TLS_1_1, TLS_1_0], supportsTlsExtensions=true), ConnectionSpec(cipherSuites=[TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECD
HE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_E
CDHE_RSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AE
S_128_GCM_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_3DES_EDE_CBC_SHA], tlsVersions=[TLS_1_0], supportsTlsExtens
ions=true), ConnectionSpec()], supported protocols=[TLSv1, TLSv1.1, TLSv1.2]

What can be wrong ? What should I do ? I want to do some updates to my existing application. And when I do it, can't get it back up.

[germanattanasio]

@asidd The customer needs to specify a different buildpack, See #610 (comment)

[joralemarti]

I solved my issue , modifying the WatsonService.java in this way.

  protected OkHttpClient configureHttpClient() {
    ConnectionSpec spec = new ConnectionSpec.Builder(ConnectionSpec.COMPATIBLE_TLS)  
    .tlsVersions(TlsVersion.TLS_1_0)
    .cipherSuites(
          CipherSuite.TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256,
          CipherSuite.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256,
          CipherSuite.TLS_DHE_RSA_WITH_AES_128_GCM_SHA256)
    .allEnabledTlsVersions()
    .supportsTlsExtensions(false)
    .allEnabledCipherSuites()
    .build();

    final OkHttpClient.Builder builder = new OkHttpClient.Builder();

    final CookieManager cookieManager = new CookieManager();
    cookieManager.setCookiePolicy(CookiePolicy.ACCEPT_ALL);

    builder.cookieJar(new JavaNetCookieJar(cookieManager));

    builder.connectTimeout(60, TimeUnit.SECONDS);
    builder.writeTimeout(60, TimeUnit.SECONDS);
    builder.readTimeout(90, TimeUnit.SECONDS);
    builder.connectionSpecs(Collections.singletonList(spec));

    return builder.build();
  }

Thanks to all.

[coxd]

@bruceadams @joralemarti has identified the key element that I missed when trying this approach: .allEnabledCipherSuites(). This overrides the cleansing of the cipher suites by OkHttp and uses the explicit set you enable in the sample socket.

[germanattanasio]

In #626 I'm updating the okhttp version to be okhttp-3.7.0-SNAPSHOT

If someone can validate that the java-sdk-3.7.1-SNAPSHOT from sonatype: https://oss.sonatype.org/content/repositories/snapshots/com/ibm/watson/developer_cloud/java-sdk/3.7.1-SNAPSHOT/ fixes the IBM JDK issue then I will release the jar to maven.

[coxd]

@germanattanasio:

All we need to do is this to continue to use 3.6.0 and which will work for all JDKs:

ConnectionSpec spec = 
    new ConnectionSpec.Builder(ConnectionSpec.MODERN_TLS)
        .allEnabledCipherSuites()
        .build();	  

builder.connectionSpecs(Collections.singletonList(spec));

See my comment in your gist for the explanation/justification.

[coxd]

@joralemarti

Thank you again for pointing out the obvious. You will notice above I do not explicitly set any cipher suites. Forgetting about the basic problem that IBM JDK and Oracle names mismatch that has caused all of this - .allEnabledCipherSuites() clears the suites you've just set.

[jtviegas]

hello All,
we are taking the jars from maven central with gradle,
3.7.1 still not in maven central, do you have an idea if it will be there soon?

thanking you in advance