I/O error on POST request for... java.net.SocketException: Connection reset

Question

I am using Spring Rest Template to call a REST service that is hosted at an SSL endpoint. After the first request, I am getting the below error. The environment is AWS EC2, Open JDK 1.8.161, Linux. The endpoint only supports TLSv1.2 and 1.3.

 org.springframework.web.client.ResourceAccessException: I/O error on POST request for "https://mycompany.com": Connection reset; nested exception is java.net.SocketException: Connection reset
        at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:743)
        at org.springframework.web.client.RestTemplate.execute(RestTemplate.java:686)
        at org.springframework.web.client.RestTemplate.postForObject(RestTemplate.java:437)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:855)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:742)
    ... more stack here
Caused by: java.net.SocketException: Connection reset
    at java.net.SocketInputStream.read(SocketInputStream.java:210)
    at java.net.SocketInputStream.read(SocketInputStream.java:141)
    at sun.security.ssl.InputRecord.readFully(InputRecord.java:465)
    at sun.security.ssl.InputRecord.read(InputRecord.java:503)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:983)
    at sun.security.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:940)
    at sun.security.ssl.AppInputStream.read(AppInputStream.java:105)
    at .....
    ... 107 common frames omitted

Any guidance will be greatly appreciated=!!

Answer 1

This quite feels like the protocol issue. The AWS is fully TLS 1.2 or higher supporting, but the client is not. The Rest Template if not configured otherwise, will start negotiation with TLS 1.0. You have to forcefully make the client to connect only with 1.2 or 1.3 protocol stacks.

In general, this can be configured while creating the client. Something similar to this

SSLContext context = SSLContext.getInstance("TLSv1.2");
context.init(null, null, null);

CloseableHttpClient httpClient = HttpClientBuilder.create().setSSLContext(context)
    .build();
HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient);
RestTemplate restTemplate = new RestTemplate(factory);

You can find how to tune the template based on the spring version. Forcing the client to negotiate only on the allowed protocols will solve this problem.