Talend Studio tRest tHttpClient SSLHandshakeException: handshake_failure caused by TLS_RSA_* cipher suites disabled from java.security

[wei_guo]

A Talend Data Integration job that retrieves exchange rates from an external government REST API fails at runtime. The failure occurs in the REST call component, and the job doesn't complete. The following exception is logged:

Exception in component tREST_1 (mJob_FT_EXCHANGE_RATE)
com.sun.jersey.api.client.ClientHandlerException:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

Resolution

First, we will verify that the correct certificates have been imported, then outline the appropriate solution. 

Verify that the required certificates are imported

Confirm that every certificate the API server needs is imported into the truststore of the JVM used by Talend. Download every certificate in the chain, saving each one as a separate file:

echo "" | openssl s_client -showcerts -connect <api-hostname>:443 | \
  awk '/BEGIN/ { i++; } /BEGIN/, /END/ { print > "a-cert-" i ".crt" }'

Then import each certificate into the truststore. There may be several certificates in the chain. Import all of them:

keytool -import -trustcacerts -alias a-cert-1 -file /tmp/a-cert-1.crt \
  -keystore <jvm>/lib/security/cacerts -storepass <truststore-password>
keytool -import -trustcacerts -alias a-cert-2 -file /tmp/a-cert-2.crt \
  -keystore <jvm>/lib/security/cacerts -storepass <truststore-password>

Check for a cipher suite conflict

If the required certificates are already imported and the error persists, check whether the client and server support a common cipher suite.

Server side: scan the endpoint to see which cipher suites it supports.

sudo dnf install nmap
nmap --script ssl-enum-ciphers -p 443 <api-hostname>

In this case, the scan listed only TLS_RSA_* ciphers.

Client side: check the JDK's java.security file for disabled algorithms.

jdk.tls.disabledAlgorithms=..., TLS_RSA_*, ...

Since the JDK 11 release of January 2026, TLS_RSA_* is disabled by default here, which is why the handshake fails.

Any of the following tools can be used to check which cipher suites a server supports:

nmap (most detailed):

nmap --script ssl-enum-ciphers -p 443 <hostname>

Lists every supported TLS version and cipher suite, with a strength grade (A–F) for each. This is the method used in this case.

testssl.sh (full report, no install needed beyond download):

git clone https://github.com/drwetter/testssl.sh.git
cd testssl.sh
./testssl.sh --cipher-per-proto <hostname>:443

Gives a per-protocol breakdown, and flags weak or deprecated ciphers (no forward secrecy, CBC, and so on).

sslscan:

sudo dnf install sslscan
sslscan <hostname>:443

Quick output showing accepted and rejected ciphers, certificate information, and protocol support.

Apply the fix on the JDK 11 client

If the external server can't be upgraded to support newer cipher suites, apply the fix on the JDK 11 client side. To avoid modifying the JDK installation itself, use a separate, customized security file:

1. Copy <java_home>/conf/java.security to a neutral location, for example <install_dir>/TalendRemoteEngine/custom.security.
2. Edit the copy, and remove TLS_RSA_* from the jdk.tls.disabledAlgorithms property.
3. Create a dedicated run profile for this job that points to the custom file:
   

   -Djava.security.properties=<install_dir>/TalendRemoteEngine/custom.security

Re-enabling TLS_RSA_* weakens transport security, because these cipher suites lack forward secrecy. Scoping the change to this one job's run profile, rather than changing the global JDK settings, limits the exposure. It's also worth asking the API provider whether they plan to support modern cipher suites.

Cause

An SSLHandshakeException with a handshake_failure generally has one of two causes: a certificate in the server's chain isn't trusted by the JVM's truststore, or the client and server can't agree on a cipher suite. In this case, investigation confirmed a cipher suite conflict between the client and the API server:

• Server side: the external API server supports only TLS_RSA_* cipher suites.
• Client side: since the JDK 11 release of January 2026, TLS_RSA_* is disabled by default in the JDK's java.security file, through the jdk.tls.disabledAlgorithms property.

Because the client refuses the only cipher family the server offers, no common cipher suite can be negotiated, which produces the SSLHandshakeException: Received fatal alert: handshake_failure error.

Environment

• Talend Studio