はじめに

SSL接続がうまく行かないときなど、細かいhandshakeの内容を知りたい場合があります。
ここではAtlassianが提供している診断用のJavaクラス「SSLPoke」を利用した接続検証方法を紹介します。

ここでは、例としてgoogle.comへの接続を検証します。
また、成功例と失敗例の検証の為にgoogle.comとyahoo.comの両方の証明書を取得して接続検証を行います。

SSLPokeの取得

以下のサイトからSSLPoke.classを事前に入手しておきます。

アトラシアンナレッジベース - PKIX パスの構築の失敗により SSL サービスに接続できない

証明書の取得

ここでは、証明書(.crt)ファイルをChromeブラウザを利用して取得します。

なお、以下のようにOpenSSLコマンドを利用して取得しても問題ありません。

OpenSSLコマンドでの取得

$ openssl s_client -connect google.com:443 -showcerts

google.com

１．まずはChromeでwww.google.comへアクセスします。

２．「Ctrl+Shift+J」で「デベロッパーツール」を開き、「Security」タブに移動します。

３．「View certificate」ボタンをクリックして証明書を表示し、「詳細」タブを開きます。

４．「ファイルにコピー(C)...」をクリックして、Base64形式で証明書を保存します。

また、同様にして中間証明書とルート証明書も取得します。
例えば中間証明書であれば「証明のパス」から中間証明書を選択して「証明書の表示」で表示できます。

それぞれ、以下の名前で保存しました。
ルート証明書：google.root.crt
中間証明書：google.intermediate.crt
証明書：google.crt

yahoo.com

google.comの場合と同じなので、省略します。

JKSの作成

証明書が取得できたら、今度はJKS(Java KeyStore)を作成します。
キーストアの生成はJREに付属しているkeytoolを利用して生成します。

通常JKSはデフォルトのキーストアとして「[JAVA_HOME]\lib\security\cacerts」が存在していますが、
ここではデフォルトのキーストアは利用せずに新規にキーストアを作成します。

google.com

google.com用のキーストアとして以下のように「google.jks」を作成します。

google.jksの作成

$ keytool -import -file certfiles/google.cer -alias google -keystore keystores/google.jks
キーストアのパスワードを入力してください:  google
新規パスワードを再入力してください: google
所有者: CN=*.google.com, O=Google Inc, L=Mountain View, ST=California, C=US
発行者: CN=Google Internet Authority G2, O=Google Inc, C=US
シリアル番号: 4fca07b959375f08
有効期間の開始日: Wed Apr 12 22:37:30 JST 2017終了日: Wed Jul 05 22:28:00 JST 2017
証明書のフィンガプリント:
         MD5:  6C:42:45:D7:EE:2A:28:67:3E:0E:F5:8C:9F:E2:86:6E
         SHA1: 89:87:DA:CB:CE:3F:DF:4B:BB:EB:E4:01:29:6D:DF:F8:F5:49:5C:71
         SHA256: 6C:FC:1B:39:23:C0:65:3C:4F:6F:2D:4F:73:0A:57:DE:9B:22:6A:9E:94:91:C5:AE:CB:10:79:01:F2:93:9F:DC
         署名アルゴリズム名: SHA256withRSA
         バージョン: 3

拡張:

# 1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: caIssuers
   accessLocation: URIName: http://pki.google.com/GIAG2.crt
,
   accessMethod: ocsp
   accessLocation: URIName: http://clients1.google.com/ocsp
]
]

# 2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 4A DD 06 16 1B BC F6 68   B5 76 F5 81 B6 BB 62 1A  J......h.v....b.
0010: BA 5A 81 2F                                        .Z./
]
]

# 3: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

# 4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://pki.google.com/GIAG2.crl]
]]

# 5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [1.3.6.1.4.1.11129.2.5.1]
[]  ]
  [CertificatePolicyId: [2.23.140.1.2.2]
[]  ]
]

# 6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

# 7: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
  DigitalSignature
]

# 8: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: *.google.com
  DNSName: *.android.com
  DNSName: *.appengine.google.com
  DNSName: *.cloud.google.com
  DNSName: *.gcp.gvt2.com
  DNSName: *.google-analytics.com
  DNSName: *.google.ca
  DNSName: *.google.cl
  DNSName: *.google.co.in
  DNSName: *.google.co.jp
  DNSName: *.google.co.uk
  DNSName: *.google.com.ar
  DNSName: *.google.com.au
  DNSName: *.google.com.br
  DNSName: *.google.com.co
  DNSName: *.google.com.mx
  DNSName: *.google.com.tr
  DNSName: *.google.com.vn
  DNSName: *.google.de
  DNSName: *.google.es
  DNSName: *.google.fr
  DNSName: *.google.hu
  DNSName: *.google.it
  DNSName: *.google.nl
  DNSName: *.google.pl
  DNSName: *.google.pt
  DNSName: *.googleadapis.com
  DNSName: *.googleapis.cn
  DNSName: *.googlecommerce.com
  DNSName: *.googlevideo.com
  DNSName: *.gstatic.cn
  DNSName: *.gstatic.com
  DNSName: *.gvt1.com
  DNSName: *.gvt2.com
  DNSName: *.metric.gstatic.com
  DNSName: *.urchin.com
  DNSName: *.url.google.com
  DNSName: *.youtube-nocookie.com
  DNSName: *.youtube.com
  DNSName: *.youtubeeducation.com
  DNSName: *.ytimg.com
  DNSName: android.clients.google.com
  DNSName: android.com
  DNSName: developer.android.google.cn
  DNSName: developers.android.google.cn
  DNSName: g.co
  DNSName: goo.gl
  DNSName: google-analytics.com
  DNSName: google.com
  DNSName: googlecommerce.com
  DNSName: source.android.google.cn
  DNSName: urchin.com
  DNSName: www.goo.gl
  DNSName: youtu.be
  DNSName: youtube.com
  DNSName: youtubeeducation.com
]

# 9: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: C7 C2 3E 01 A4 D3 F4 4E   DE 59 7F 98 31 7D C0 8B  ..>....N.Y..1...
0010: 88 C5 1D 9A                                        ....
]
]

この証明書を信頼しますか。 [いいえ]:  y
証明書がキーストアに追加されました

同様にして同じキーストアに「中間証明書」、「ルート証明書」もインポートします。
注意点として、alias名はそれぞれ違う名前を指定する必要があります。

google.jks(中間証明書)

$ keytool -import -file certfiles/google.intermediate.cer -alias intermediate -keystore keystores/google.jks

google.jks(ルート証明書)

$ keytool -import -file certfiles/google.root.cer -alias root -keystore keystores/google.jks

yahoo.com

google.comと同様に「yahoo.jks」を作成します。
※キーストアのパスワードは最低6文字が必要なので"yahooo"にしています。

yahoo.jksの作成

$ keytool -import -file certfiles/yahoo.cer -alias yahoo -keystore keystores/yahoo.jks
キーストアのパスワードを入力してください:  yahooo
新規パスワードを再入力してください: yahooo
所有者: CN=www.yahoo.com, OU=Information Technology, O=Yahoo Inc., L=Sunnyvale, ST=California, C=US
発行者: CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US
シリアル番号: 1c25430ed0a602e8cc3a977b0539cce5
有効期間の開始日: Sat Oct 31 09:00:00 JST 2015終了日: Tue Oct 31 08:59:59 JST 2017
証明書のフィンガプリント:
         MD5:  58:49:71:94:C6:6F:68:3E:5B:F1:A2:29:37:CC:AA:8C
         SHA1: 41:30:72:F8:03:CE:96:12:10:E9:A4:5D:10:DA:14:B0:D2:D4:85:32
         SHA256: FE:37:33:E2:40:84:5F:69:C9:51:5D:3C:8B:A0:26:6B:51:FB:C7:07:A7:42:7A:43:E3:1D:E5:24:EE:C7:C3:1C
         署名アルゴリズム名: SHA256withRSA
         バージョン: 3

拡張:

# 1: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://ss.symcd.com
,
   accessMethod: caIssuers
   accessLocation: URIName: http://ss.symcb.com/ss.crt
]
]

# 2: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 5F 60 CF 61 90 55 DF 84   43 14 8A 60 2A B2 F5 7A  _`.a.U..C..`*..z
0010: F4 43 18 EF                                        .C..
]
]

# 3: ObjectId: 2.5.29.19 Criticality=false
BasicConstraints:[
  CA:false
  PathLen: undefined
]

# 4: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://ss.symcb.com/ss.crl]
]]

# 5: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.23.140.1.2.2]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 17 68 74 74 70 73 3A   2F 2F 64 2E 73 79 6D 63  ..https://d.symc
0010: 62 2E 63 6F 6D 2F 63 70   73                       b.com/cps

], PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.2
  qualifier: 0000: 30 19 1A 17 68 74 74 70   73 3A 2F 2F 64 2E 73 79  0...https://d.sy
0010: 6D 63 62 2E 63 6F 6D 2F   72 70 61                 mcb.com/rpa

]]  ]
]

# 6: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

# 7: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  DigitalSignature
  Key_Encipherment
]

# 8: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: www.yahoo.com
  DNSName: yahoo.com
  DNSName: hsrd.yahoo.com
  DNSName: us.yahoo.com
  DNSName: fr.yahoo.com
  DNSName: uk.yahoo.com
  DNSName: za.yahoo.com
  DNSName: ie.yahoo.com
  DNSName: it.yahoo.com
  DNSName: es.yahoo.com
  DNSName: de.yahoo.com
  DNSName: ca.yahoo.com
  DNSName: qc.yahoo.com
  DNSName: br.yahoo.com
  DNSName: ro.yahoo.com
  DNSName: se.yahoo.com
  DNSName: be.yahoo.com
  DNSName: fr-be.yahoo.com
  DNSName: ar.yahoo.com
  DNSName: mx.yahoo.com
  DNSName: cl.yahoo.com
  DNSName: co.yahoo.com
  DNSName: ve.yahoo.com
  DNSName: espanol.yahoo.com
  DNSName: pe.yahoo.com
  DNSName: in.yahoo.com
  DNSName: sg.yahoo.com
  DNSName: id.yahoo.com
  DNSName: malaysia.yahoo.com
  DNSName: ph.yahoo.com
  DNSName: vn.yahoo.com
  DNSName: maktoob.yahoo.com
  DNSName: en-maktoob.yahoo.com
  DNSName: ca.my.yahoo.com
  DNSName: gr.yahoo.com
  DNSName: att.yahoo.com
  DNSName: au.yahoo.com
  DNSName: nz.yahoo.com
  DNSName: tw.yahoo.com
  DNSName: hk.yahoo.com
  DNSName: brb.yahoo.com
  DNSName: my.yahoo.com
  DNSName: add.my.yahoo.com
  DNSName: frontier.yahoo.com
  DNSName: verizon.yahoo.com
  DNSName: ca.rogers.yahoo.com
  DNSName: fr-ca.rogers.yahoo.com
  DNSName: tatadocomo.yahoo.com
  DNSName: tikona.yahoo.com
  DNSName: ideanetsetter.yahoo.com
  DNSName: mtsindia.yahoo.com
  DNSName: smartfren.yahoo.com
  DNSName: *.att.yahoo.com
  DNSName: *.people.yahoo.com
  DNSName: *.celebrity.yahoo.com
  DNSName: *.vida-estilo.yahoo.com
  DNSName: *.style.yahoo.com
  DNSName: *.movies.yahoo.com
  DNSName: *.stars.yahoo.com
  DNSName: *.kino.yahoo.com
  DNSName: *.cine.yahoo.com
  DNSName: *.cinema.yahoo.com
  DNSName: *.celebridades.yahoo.com
  DNSName: *.live.yahoo.com
  DNSName: *.beauty.yahoo.com
]

この証明書を信頼しますか。 [いいえ]:  y
証明書がキーストアに追加されました

中間証明書、ルート証明書も同様にインポートしてください。

SSLPokeを利用したSSL接続検証

ここまでで準備ができたので、SSLPokeを利用してSSL接続検証を行います。

SSLPokeは以下のコマンドで接続検証ができますが、ここでは細かいハンドシェイクを見るために
オプションとして「Djavax.net.debug=ssl,handshake」を指定しています。

また、キーストアは何も指定しないと前述したデフォルトのキーストアを参照するので
「-Djavax.net.ssl.trustStore」オプションと「-Djavax.net.ssl.trustStorePassword」オプションを利用して明示的に指定しています。

yahoo.jksでgoogle.comへ接続

これは失敗するパターンです。
トラストストアとしてyahoo.comの証明書しかないキーストアを利用してgoogle.comへ接続しようとしています。

yahoo.jksでgoogle.comへ接続

java -Djavax.net.ssl.trustStore=keystores/yahoo.jks -Djavax.net.ssl.trustStorePassword=yahooo -Djavax.net.debug=ssl,handshake SSLPoke google.com 443
trustStore is: keystores\yahoo.jks
trustStore type is : jks
trustStore provider is :
init truststore
adding as trusted cert:
  Subject: CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  Issuer:  CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
  Algorithm: RSA; Serial number: 0x513fb9743870b73440418d30930699ff
  Valid from Thu Oct 31 09:00:00 JST 2013 until Tue Oct 31 08:59:59 JST 2023

adding as trusted cert:
  Subject: CN=www.yahoo.com, OU=Information Technology, O=Yahoo Inc., L=Sunnyvale, ST=California, C=US
  Issuer:  CN=Symantec Class 3 Secure Server CA - G4, OU=Symantec Trust Network, O=Symantec Corporation, C=US
  Algorithm: RSA; Serial number: 0x1c25430ed0a602e8cc3a977b0539cce5
  Valid from Sat Oct 31 09:00:00 JST 2015 until Tue Oct 31 08:59:59 JST 2017

adding as trusted cert:
  Subject: CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
  Issuer:  CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU="(c) 2006 VeriSign, Inc. - For authorized use only", OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US
  Algorithm: RSA; Serial number: 0x18dad19e267de8bb4a2158cdcc6b3b4a
  Valid from Wed Nov 08 09:00:00 JST 2006 until Thu Jul 17 08:59:59 JST 2036

keyStore is :
keyStore type is : jks
keyStore provider is :
init keystore
init keymanager of type SunX509
trigger seeding of SecureRandom
done seeding SecureRandom
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1493373611 bytes = { 74, 79, 25, 73, 94, 244, 238, 98, 59, 99, 58, 149, 85, 164, 25, 89, 188, 129, 239, 77, 113, 178, 53, 122, 161, 251, 246, 141 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Extension server_name, server_name: [type=host_name (0), value=google.com]
***
main, WRITE: TLSv1.2 Handshake, length = 222
main, READ: TLSv1.2 Handshake, length = 87
*** ServerHello, TLSv1.2
RandomCookie:  GMT: 1493373610 bytes = { 8, 14, 157, 199, 79, 230, 132, 127, 193, 13, 186, 62, 120, 46, 184, 133, 203, 240, 47, 208, 179, 15, 147, 194, 84, 166, 177, 251 }
Session ID:  {65, 22, 118, 24, 34, 177, 101, 173, 207, 106, 149, 43, 178, 26, 22, 115, 187, 61, 241, 194, 96, 109, 132, 37, 4, 120, 236, 153, 26, 62, 255, 89}
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Compression Method: 0
Extension renegotiation_info, renegotiated_connection: <empty>
Extension ec_point_formats, formats: [uncompressed]
***
%% Initialized:  [Session-1, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256]
** TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
main, READ: TLSv1.2 Handshake, length = 3813
*** Certificate chain
chain [0] = [
[
  Version: V3
  Subject: CN=*.google.com, O=Google Inc, L=Mountain View, ST=California, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun EC public key, 256 bits
  public x coord: 15857649762105096772968051547638456909892305426137858367128632380206196964288
  public y coord: 48779184071160655230510496126717706041261646117444654293733038245412446736917
  parameters: secp256r1 [NIST P-256, X9.62 prime256v1] (1.2.840.10045.3.1.7)
  Validity: [From: Wed Apr 12 22:37:30 JST 2017,
               To: Wed Jul 05 22:28:00 JST 2017]
  Issuer: CN=Google Internet Authority G2, O=Google Inc, C=US
  SerialNumber: [    4fca07b9 59375f08]

Certificate Extensions: 9
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: caIssuers
   accessLocation: URIName: http://pki.google.com/GIAG2.crt
,
   accessMethod: ocsp
   accessLocation: URIName: http://clients1.google.com/ocsp
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 4A DD 06 16 1B BC F6 68   B5 76 F5 81 B6 BB 62 1A  J......h.v....b.
0010: BA 5A 81 2F                                        .Z./
]
]

[3]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://pki.google.com/GIAG2.crl]
]]

[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [1.3.6.1.4.1.11129.2.5.1]
[]  ]
  [CertificatePolicyId: [2.23.140.1.2.2]
[]  ]
]

[6]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

[7]: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
  DigitalSignature
]

[8]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: *.google.com
  DNSName: *.android.com
  DNSName: *.appengine.google.com
  DNSName: *.cloud.google.com
  DNSName: *.gcp.gvt2.com
  DNSName: *.google-analytics.com
  DNSName: *.google.ca
  DNSName: *.google.cl
  DNSName: *.google.co.in
  DNSName: *.google.co.jp
  DNSName: *.google.co.uk
  DNSName: *.google.com.ar
  DNSName: *.google.com.au
  DNSName: *.google.com.br
  DNSName: *.google.com.co
  DNSName: *.google.com.mx
  DNSName: *.google.com.tr
  DNSName: *.google.com.vn
  DNSName: *.google.de
  DNSName: *.google.es
  DNSName: *.google.fr
  DNSName: *.google.hu
  DNSName: *.google.it
  DNSName: *.google.nl
  DNSName: *.google.pl
  DNSName: *.google.pt
  DNSName: *.googleadapis.com
  DNSName: *.googleapis.cn
  DNSName: *.googlecommerce.com
  DNSName: *.googlevideo.com
  DNSName: *.gstatic.cn
  DNSName: *.gstatic.com
  DNSName: *.gvt1.com
  DNSName: *.gvt2.com
  DNSName: *.metric.gstatic.com
  DNSName: *.urchin.com
  DNSName: *.url.google.com
  DNSName: *.youtube-nocookie.com
  DNSName: *.youtube.com
  DNSName: *.youtubeeducation.com
  DNSName: *.ytimg.com
  DNSName: android.clients.google.com
  DNSName: android.com
  DNSName: developer.android.google.cn
  DNSName: developers.android.google.cn
  DNSName: g.co
  DNSName: goo.gl
  DNSName: google-analytics.com
  DNSName: google.com
  DNSName: googlecommerce.com
  DNSName: source.android.google.cn
  DNSName: urchin.com
  DNSName: www.goo.gl
  DNSName: youtu.be
  DNSName: youtube.com
  DNSName: youtubeeducation.com
]

[9]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: C7 C2 3E 01 A4 D3 F4 4E   DE 59 7F 98 31 7D C0 8B  ..>....N.Y..1...
0010: 88 C5 1D 9A                                        ....
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 61 F7 94 99 58 C7 7A AD   99 45 F7 C9 43 0C 6E 8C  a...X.z..E..C.n.
0010: 1A D8 0C 7C 96 51 29 B8   01 1B 2D FB C4 E8 AB BA  .....Q)...-.....
0020: AC C0 B0 69 49 3A 8C 81   67 3C 3D 74 0D 0B E5 0D  ...iI:..g<=t....
0030: 98 04 32 AB 52 CA D1 1E   BD 9A 24 43 99 AB 33 B7  ..2.R.....$C..3.
0040: A3 77 1E 2B 4E FB 47 0E   F3 2E 44 58 2B 2F EE B3  .w.+N.G...DX+/..
0050: AB 9F ED E4 D6 37 9B CC   42 13 53 18 4D EB 57 29  .....7..B.S.M.W)
0060: 71 FF 2E 3D 79 28 0A C3   30 36 DF C0 A2 59 CB 4D  q..=y(..06...Y.M
0070: 69 74 A3 94 4E 64 A0 D0   B5 55 22 B2 80 3E 2F 4A  it..Nd...U"..>/J
0080: 25 15 49 57 35 3D 84 26   C6 3A F6 67 38 BE F1 49  %.IW5=.&.:.g8..I
0090: 35 01 17 D4 A7 A2 35 A3   D6 9E D8 2A 15 FD EA E5  5.....5....*....
00A0: 88 34 69 C2 D9 F6 07 9F   6C CD 7A 60 1E 28 E3 E8  .4i.....l.z`.(..
00B0: E3 3B FA 7A 19 89 BA 43   0C F9 2A C1 61 9F 80 DA  .;.z...C..*.a...
00C0: C2 0A 61 E9 C0 31 64 DC   F0 C1 3C 01 E5 83 A8 89  ..a..1d...<.....
00D0: 79 43 23 48 88 FB E6 8C   08 0E E1 1E 51 5F F1 C5  yC#H........Q_..
00E0: 11 49 C0 E6 F3 E8 2D 30   E6 8B 26 CE F9 55 83 C8  .I....-0..&..U..
00F0: F2 B2 B6 C6 E8 4E 53 D6   E6 D5 F8 B2 F8 C3 23 61  .....NS.......#a

]
chain [1] = [
[
  Version: V3
  Subject: CN=Google Internet Authority G2, O=Google Inc, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  modulus: 19713895149719550196537065661910573762693934593220985668782860735427060889140793885919063737778303548724916253252606564904177491762533295616984617709378739783748100146882543612565825906799282133510087546060971220666055151463898734279731009956582933624646298029265838127046200538496591314458940937082185029845612274584845875286257057247598474925565775989866310636633768255501748172403430876460228793912189332026189491067186811703150477068536877439284697584041860237489395099402658887745588613142391209024263265842301844868193180477031165936332420984796347731387363914950895491332976177715889375379088870580457661428329
  public exponent: 65537
  Validity: [From: Wed Apr 01 09:00:00 JST 2015,
               To: Mon Jan 01 08:59:59 JST 2018]
  Issuer: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
  SerialNumber: [    023a92]

Certificate Extensions: 7
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://g.symcd.com
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: C0 7A 98 68 8D 89 FB AB   05 64 0C 11 7D AA 7D 65  .z.h.....d.....e
0010: B8 CA CC 4E                                        ...N
]
]

[3]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:0
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://g.symcb.com/crls/gtglobal.crl]
]]

[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [1.3.6.1.4.1.11129.2.5.1]
[]  ]
]

[6]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  Key_CertSign
  Crl_Sign
]

[7]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 4A DD 06 16 1B BC F6 68   B5 76 F5 81 B6 BB 62 1A  J......h.v....b.
0010: BA 5A 81 2F                                        .Z./
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 08 4E 04 A7 80 7F 10 16   43 5E 02 AD D7 42 80 F4  .N......C^...B..
0010: B0 8E D2 AE B3 EB 11 7D   90 84 18 7D E7 90 15 FB  ................
0020: 49 7F A8 99 05 91 BB 7A   C9 D6 3C 37 18 09 9A B6  I......z..<7....
0030: C7 92 20 07 35 33 09 E4   28 63 72 0D B4 E0 32 9C  .. .53..(cr...2.
0040: 87 98 C4 1B 76 89 67 C1   50 58 B0 13 AA 13 1A 1B  ....v.g.PX......
0050: 32 A5 BE EA 11 95 4C 48   63 49 E9 99 5D 20 37 CC  2.....LHcI..] 7.
0060: FE 2A 69 51 16 95 4B A9   DE 49 82 C0 10 70 F4 2C  .*iQ..K..I...p.,
0070: F3 EC BC 24 24 D0 4E AC   A5 D9 5E 1E 6D 92 C1 A7  ...$$.N...^.m...
0080: AC 48 35 81 F9 E5 E4 9C   65 69 CD 87 A4 41 50 3F  .H5.....ei...AP?
0090: 2E 57 A5 91 51 12 58 0E   8C 09 A1 AC 7A A4 12 A5  .W..Q.X.....z...
00A0: 27 F3 9A 10 97 7D 55 03   06 F7 66 58 5F 5F 64 E1  '.....U...fX__d.
00B0: AB 5D 6D A5 39 48 75 98   4C 29 5A 3A 8D D3 2B CA  .]m.9Hu.L)Z:..+.
00C0: 9C 55 04 BF F4 E6 14 D5   80 AC 26 ED 17 89 A6 93  .U........&.....
00D0: 6C 5C A4 CC B8 F0 66 8E   64 E3 7D 9A E2 00 B3 49  l\....f.d......I
00E0: C7 E4 0A AA DD 5B 83 C7   70 90 46 4E BE D0 DB 59  .....[..p.FN...Y
00F0: 96 6C 2E F5 16 36 DE 71   CC 01 C2 12 C1 21 C6 16  .l...6.q.....!..

]
chain [2] = [
[
  Version: V3
  Subject: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
  Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5

  Key:  Sun RSA public key, 2048 bits
  modulus: 27620593608073140957439440929253438012688864718977347268272053725994928948867769687165112265058896553974818505070806430256424431940072485024407486246475597522063246121214348496326377341879755851197260401080498544606788760407243324127929930612201002157618691487713632251700065187865963692723720912135393438861302779432180613616167225206519123176430362410262429702404863434904116727055203524505580952824336979641923534005571504410997292144760317953739063178352809680844232935574095508445145910310675421726257114605895831426222686272114090063230017292595425393719031924942422176213538487957041730136782988405751614792953
  public exponent: 65537
  Validity: [From: Tue May 21 13:00:00 JST 2002,
               To: Tue Aug 21 13:00:00 JST 2018]
  Issuer: OU=Equifax Secure Certificate Authority, O=Equifax, C=US
  SerialNumber: [    12bbe6]

Certificate Extensions: 6
[1]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 48 E6 68 F9 2B D2 B2 95   D7 47 D8 23 20 10 4F 33  H.h.+....G.# .O3
0010: 98 90 9F D4                                        ....
]
]

[2]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

[3]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.geotrust.com/crls/secureca.crl]
]]

[4]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.5.29.32.0]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 2D 68 74 74 70 73 3A   2F 2F 77 77 77 2E 67 65  .-https://www.ge
0010: 6F 74 72 75 73 74 2E 63   6F 6D 2F 72 65 73 6F 75  otrust.com/resou
0020: 72 63 65 73 2F 72 65 70   6F 73 69 74 6F 72 79     rces/repository

]]  ]
]

[5]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  Key_CertSign
  Crl_Sign
]

[6]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: C0 7A 98 68 8D 89 FB AB   05 64 0C 11 7D AA 7D 65  .z.h.....d.....e
0010: B8 CA CC 4E                                        ...N
]
]

]
  Algorithm: [SHA1withRSA]
  Signature:
0000: 76 E1 12 6E 4E 4B 16 12   86 30 06 B2 81 08 CF F0  v..nNK...0......
0010: 08 C7 C7 71 7E 66 EE C2   ED D4 3B 1F FF F0 F0 C8  ...q.f....;.....
0020: 4E D6 43 38 B0 B9 30 7D   18 D0 55 83 A2 6A CB 36  N.C8..0...U..j.6
0030: 11 9C E8 48 66 A3 6D 7F   B8 13 D4 47 FE 8B 5A 5C  ...Hf.m....G..Z\
0040: 73 FC AE D9 1B 32 19 38   AB 97 34 14 AA 96 D2 EB  s....2.8..4.....
0050: A3 1C 14 08 49 B6 BB E5   91 EF 83 36 EB 1D 56 6F  ....I......6..Vo
0060: CA DA BC 73 63 90 E4 7F   7B 3E 22 CB 3D 07 ED 5F  ...sc....>".=.._
0070: 38 74 9C E3 03 50 4E A1   AF 98 EE 61 F2 84 3F 12  8t...PN....a..?.

]
***
%% Invalidated:  [Session-1, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256]
main, SEND TLSv1.2 ALERT:  fatal, description = certificate_unknown
main, WRITE: TLSv1.2 Alert, length = 2
main, called closeSocket()
main, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
        at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
        at sun.security.validator.Validator.validate(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
        at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
        at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
        at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
        at sun.security.ssl.Handshaker.processLoop(Unknown Source)
        at sun.security.ssl.Handshaker.process_record(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.writeRecord(Unknown Source)
        at sun.security.ssl.AppOutputStream.write(Unknown Source)
        at sun.security.ssl.AppOutputStream.write(Unknown Source)
        at SSLPoke.main(SSLPoke.java:31)
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
        at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
        at java.security.cert.CertPathBuilder.build(Unknown Source)
        ... 16 more

main, SEND TLSv1.2 ALERT: fatal, description = certificate_unknown
と出ていますね。

google.jksでgoogle.comへ接続

これは成功するパターンです。
トラストストアとしてgoogle.comの証明書しかないキーストアを利用してgoogle.comへ接続しようとしています。

jksでgoogle.jksでgoogle.comへ接続

$ java -Djavax.net.ssl.trustStore=keystores/google.jks -Djavax.net.ssl.trustStorePassword=google -Djavax.net.debug=ssl,handshake SSLPoke google.com 443
trustStore is: keystores\google.jks
trustStore type is : jks
trustStore provider is :
init truststore
adding as trusted cert:
  Subject: CN=Google Internet Authority G2, O=Google Inc, C=US
  Issuer:  CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
  Algorithm: RSA; Serial number: 0x23a92
  Valid from Wed Apr 01 09:00:00 JST 2015 until Mon Jan 01 08:59:59 JST 2018

adding as trusted cert:
  Subject: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
  Issuer:  CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
  Algorithm: RSA; Serial number: 0x23456
  Valid from Tue May 21 13:00:00 JST 2002 until Sat May 21 13:00:00 JST 2022

adding as trusted cert:
  Subject: CN=*.google.com, O=Google Inc, L=Mountain View, ST=California, C=US
  Issuer:  CN=Google Internet Authority G2, O=Google Inc, C=US
  Algorithm: EC; Serial number: 0x4fca07b959375f08
  Valid from Wed Apr 12 22:37:30 JST 2017 until Wed Jul 05 22:28:00 JST 2017

keyStore is :
keyStore type is : jks
keyStore provider is :
init keystore
init keymanager of type SunX509
trigger seeding of SecureRandom
done seeding SecureRandom
Allow unsafe renegotiation: false
Allow legacy hello messages: true
Is initial handshake: true
Is secure renegotiation: false
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1
Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256 for TLSv1.1
Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256 for TLSv1.1
%% No cached client session
*** ClientHello, TLSv1.2
RandomCookie:  GMT: 1493373667 bytes = { 211, 165, 121, 86, 252, 7, 118, 68, 9, 16, 158, 80, 244, 116, 50, 132, 235, 3, 124, 174, 182, 254, 206, 181, 73, 78, 152, 136 }
Session ID:  {}
Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA, TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
Compression Methods:  { 0 }
Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, secp256k1}
Extension ec_point_formats, formats: [uncompressed]
Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Extension server_name, server_name: [type=host_name (0), value=google.com]
***
main, WRITE: TLSv1.2 Handshake, length = 222
main, READ: TLSv1.2 Handshake, length = 87
*** ServerHello, TLSv1.2
RandomCookie:  GMT: 1493373666 bytes = { 68, 62, 71, 118, 84, 161, 72, 22, 187, 65, 171, 73, 117, 199, 49, 63, 110, 111, 166, 227, 204, 226, 126, 51, 208, 35, 189, 219 }
Session ID:  {141, 9, 13, 140, 215, 84, 61, 114, 50, 35, 232, 75, 135, 15, 200, 152, 230, 8, 26, 30, 44, 8, 147, 22, 133, 34, 128, 236, 3, 157, 131, 185}
Cipher Suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
Compression Method: 0
Extension renegotiation_info, renegotiated_connection: <empty>
Extension ec_point_formats, formats: [uncompressed]
***
%% Initialized:  [Session-1, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256]
** TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
main, READ: TLSv1.2 Handshake, length = 3813
*** Certificate chain
chain [0] = [
[
  Version: V3
  Subject: CN=*.google.com, O=Google Inc, L=Mountain View, ST=California, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun EC public key, 256 bits
  public x coord: 15857649762105096772968051547638456909892305426137858367128632380206196964288
  public y coord: 48779184071160655230510496126717706041261646117444654293733038245412446736917
  parameters: secp256r1 [NIST P-256, X9.62 prime256v1] (1.2.840.10045.3.1.7)
  Validity: [From: Wed Apr 12 22:37:30 JST 2017,
               To: Wed Jul 05 22:28:00 JST 2017]
  Issuer: CN=Google Internet Authority G2, O=Google Inc, C=US
  SerialNumber: [    4fca07b9 59375f08]

Certificate Extensions: 9
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: caIssuers
   accessLocation: URIName: http://pki.google.com/GIAG2.crt
,
   accessMethod: ocsp
   accessLocation: URIName: http://clients1.google.com/ocsp
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 4A DD 06 16 1B BC F6 68   B5 76 F5 81 B6 BB 62 1A  J......h.v....b.
0010: BA 5A 81 2F                                        .Z./
]
]

[3]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://pki.google.com/GIAG2.crl]
]]

[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [1.3.6.1.4.1.11129.2.5.1]
[]  ]
  [CertificatePolicyId: [2.23.140.1.2.2]
[]  ]
]

[6]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

[7]: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
  DigitalSignature
]

[8]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: *.google.com
  DNSName: *.android.com
  DNSName: *.appengine.google.com
  DNSName: *.cloud.google.com
  DNSName: *.gcp.gvt2.com
  DNSName: *.google-analytics.com
  DNSName: *.google.ca
  DNSName: *.google.cl
  DNSName: *.google.co.in
  DNSName: *.google.co.jp
  DNSName: *.google.co.uk
  DNSName: *.google.com.ar
  DNSName: *.google.com.au
  DNSName: *.google.com.br
  DNSName: *.google.com.co
  DNSName: *.google.com.mx
  DNSName: *.google.com.tr
  DNSName: *.google.com.vn
  DNSName: *.google.de
  DNSName: *.google.es
  DNSName: *.google.fr
  DNSName: *.google.hu
  DNSName: *.google.it
  DNSName: *.google.nl
  DNSName: *.google.pl
  DNSName: *.google.pt
  DNSName: *.googleadapis.com
  DNSName: *.googleapis.cn
  DNSName: *.googlecommerce.com
  DNSName: *.googlevideo.com
  DNSName: *.gstatic.cn
  DNSName: *.gstatic.com
  DNSName: *.gvt1.com
  DNSName: *.gvt2.com
  DNSName: *.metric.gstatic.com
  DNSName: *.urchin.com
  DNSName: *.url.google.com
  DNSName: *.youtube-nocookie.com
  DNSName: *.youtube.com
  DNSName: *.youtubeeducation.com
  DNSName: *.ytimg.com
  DNSName: android.clients.google.com
  DNSName: android.com
  DNSName: developer.android.google.cn
  DNSName: developers.android.google.cn
  DNSName: g.co
  DNSName: goo.gl
  DNSName: google-analytics.com
  DNSName: google.com
  DNSName: googlecommerce.com
  DNSName: source.android.google.cn
  DNSName: urchin.com
  DNSName: www.goo.gl
  DNSName: youtu.be
  DNSName: youtube.com
  DNSName: youtubeeducation.com
]

[9]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: C7 C2 3E 01 A4 D3 F4 4E   DE 59 7F 98 31 7D C0 8B  ..>....N.Y..1...
0010: 88 C5 1D 9A                                        ....
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 61 F7 94 99 58 C7 7A AD   99 45 F7 C9 43 0C 6E 8C  a...X.z..E..C.n.
0010: 1A D8 0C 7C 96 51 29 B8   01 1B 2D FB C4 E8 AB BA  .....Q)...-.....
0020: AC C0 B0 69 49 3A 8C 81   67 3C 3D 74 0D 0B E5 0D  ...iI:..g<=t....
0030: 98 04 32 AB 52 CA D1 1E   BD 9A 24 43 99 AB 33 B7  ..2.R.....$C..3.
0040: A3 77 1E 2B 4E FB 47 0E   F3 2E 44 58 2B 2F EE B3  .w.+N.G...DX+/..
0050: AB 9F ED E4 D6 37 9B CC   42 13 53 18 4D EB 57 29  .....7..B.S.M.W)
0060: 71 FF 2E 3D 79 28 0A C3   30 36 DF C0 A2 59 CB 4D  q..=y(..06...Y.M
0070: 69 74 A3 94 4E 64 A0 D0   B5 55 22 B2 80 3E 2F 4A  it..Nd...U"..>/J
0080: 25 15 49 57 35 3D 84 26   C6 3A F6 67 38 BE F1 49  %.IW5=.&.:.g8..I
0090: 35 01 17 D4 A7 A2 35 A3   D6 9E D8 2A 15 FD EA E5  5.....5....*....
00A0: 88 34 69 C2 D9 F6 07 9F   6C CD 7A 60 1E 28 E3 E8  .4i.....l.z`.(..
00B0: E3 3B FA 7A 19 89 BA 43   0C F9 2A C1 61 9F 80 DA  .;.z...C..*.a...
00C0: C2 0A 61 E9 C0 31 64 DC   F0 C1 3C 01 E5 83 A8 89  ..a..1d...<.....
00D0: 79 43 23 48 88 FB E6 8C   08 0E E1 1E 51 5F F1 C5  yC#H........Q_..
00E0: 11 49 C0 E6 F3 E8 2D 30   E6 8B 26 CE F9 55 83 C8  .I....-0..&..U..
00F0: F2 B2 B6 C6 E8 4E 53 D6   E6 D5 F8 B2 F8 C3 23 61  .....NS.......#a

]
chain [1] = [
[
  Version: V3
  Subject: CN=Google Internet Authority G2, O=Google Inc, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun RSA public key, 2048 bits
  modulus: 19713895149719550196537065661910573762693934593220985668782860735427060889140793885919063737778303548724916253252606564904177491762533295616984617709378739783748100146882543612565825906799282133510087546060971220666055151463898734279731009956582933624646298029265838127046200538496591314458940937082185029845612274584845875286257057247598474925565775989866310636633768255501748172403430876460228793912189332026189491067186811703150477068536877439284697584041860237489395099402658887745588613142391209024263265842301844868193180477031165936332420984796347731387363914950895491332976177715889375379088870580457661428329
  public exponent: 65537
  Validity: [From: Wed Apr 01 09:00:00 JST 2015,
               To: Mon Jan 01 08:59:59 JST 2018]
  Issuer: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
  SerialNumber: [    023a92]

Certificate Extensions: 7
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: ocsp
   accessLocation: URIName: http://g.symcd.com
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: C0 7A 98 68 8D 89 FB AB   05 64 0C 11 7D AA 7D 65  .z.h.....d.....e
0010: B8 CA CC 4E                                        ...N
]
]

[3]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:0
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://g.symcb.com/crls/gtglobal.crl]
]]

[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [1.3.6.1.4.1.11129.2.5.1]
[]  ]
]

[6]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  Key_CertSign
  Crl_Sign
]

[7]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: 4A DD 06 16 1B BC F6 68   B5 76 F5 81 B6 BB 62 1A  J......h.v....b.
0010: BA 5A 81 2F                                        .Z./
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 08 4E 04 A7 80 7F 10 16   43 5E 02 AD D7 42 80 F4  .N......C^...B..
0010: B0 8E D2 AE B3 EB 11 7D   90 84 18 7D E7 90 15 FB  ................
0020: 49 7F A8 99 05 91 BB 7A   C9 D6 3C 37 18 09 9A B6  I......z..<7....
0030: C7 92 20 07 35 33 09 E4   28 63 72 0D B4 E0 32 9C  .. .53..(cr...2.
0040: 87 98 C4 1B 76 89 67 C1   50 58 B0 13 AA 13 1A 1B  ....v.g.PX......
0050: 32 A5 BE EA 11 95 4C 48   63 49 E9 99 5D 20 37 CC  2.....LHcI..] 7.
0060: FE 2A 69 51 16 95 4B A9   DE 49 82 C0 10 70 F4 2C  .*iQ..K..I...p.,
0070: F3 EC BC 24 24 D0 4E AC   A5 D9 5E 1E 6D 92 C1 A7  ...$$.N...^.m...
0080: AC 48 35 81 F9 E5 E4 9C   65 69 CD 87 A4 41 50 3F  .H5.....ei...AP?
0090: 2E 57 A5 91 51 12 58 0E   8C 09 A1 AC 7A A4 12 A5  .W..Q.X.....z...
00A0: 27 F3 9A 10 97 7D 55 03   06 F7 66 58 5F 5F 64 E1  '.....U...fX__d.
00B0: AB 5D 6D A5 39 48 75 98   4C 29 5A 3A 8D D3 2B CA  .]m.9Hu.L)Z:..+.
00C0: 9C 55 04 BF F4 E6 14 D5   80 AC 26 ED 17 89 A6 93  .U........&.....
00D0: 6C 5C A4 CC B8 F0 66 8E   64 E3 7D 9A E2 00 B3 49  l\....f.d......I
00E0: C7 E4 0A AA DD 5B 83 C7   70 90 46 4E BE D0 DB 59  .....[..p.FN...Y
00F0: 96 6C 2E F5 16 36 DE 71   CC 01 C2 12 C1 21 C6 16  .l...6.q.....!..

]
chain [2] = [
[
  Version: V3
  Subject: CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
  Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5

  Key:  Sun RSA public key, 2048 bits
  modulus: 27620593608073140957439440929253438012688864718977347268272053725994928948867769687165112265058896553974818505070806430256424431940072485024407486246475597522063246121214348496326377341879755851197260401080498544606788760407243324127929930612201002157618691487713632251700065187865963692723720912135393438861302779432180613616167225206519123176430362410262429702404863434904116727055203524505580952824336979641923534005571504410997292144760317953739063178352809680844232935574095508445145910310675421726257114605895831426222686272114090063230017292595425393719031924942422176213538487957041730136782988405751614792953
  public exponent: 65537
  Validity: [From: Tue May 21 13:00:00 JST 2002,
               To: Tue Aug 21 13:00:00 JST 2018]
  Issuer: OU=Equifax Secure Certificate Authority, O=Equifax, C=US
  SerialNumber: [    12bbe6]

Certificate Extensions: 6
[1]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 48 E6 68 F9 2B D2 B2 95   D7 47 D8 23 20 10 4F 33  H.h.+....G.# .O3
0010: 98 90 9F D4                                        ....
]
]

[2]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:true
  PathLen:2147483647
]

[3]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://crl.geotrust.com/crls/secureca.crl]
]]

[4]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [2.5.29.32.0]
[PolicyQualifierInfo: [
  qualifierID: 1.3.6.1.5.5.7.2.1
  qualifier: 0000: 16 2D 68 74 74 70 73 3A   2F 2F 77 77 77 2E 67 65  .-https://www.ge
0010: 6F 74 72 75 73 74 2E 63   6F 6D 2F 72 65 73 6F 75  otrust.com/resou
0020: 72 63 65 73 2F 72 65 70   6F 73 69 74 6F 72 79     rces/repository

]]  ]
]

[5]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
  Key_CertSign
  Crl_Sign
]

[6]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: C0 7A 98 68 8D 89 FB AB   05 64 0C 11 7D AA 7D 65  .z.h.....d.....e
0010: B8 CA CC 4E                                        ...N
]
]

]
  Algorithm: [SHA1withRSA]
  Signature:
0000: 76 E1 12 6E 4E 4B 16 12   86 30 06 B2 81 08 CF F0  v..nNK...0......
0010: 08 C7 C7 71 7E 66 EE C2   ED D4 3B 1F FF F0 F0 C8  ...q.f....;.....
0020: 4E D6 43 38 B0 B9 30 7D   18 D0 55 83 A2 6A CB 36  N.C8..0...U..j.6
0030: 11 9C E8 48 66 A3 6D 7F   B8 13 D4 47 FE 8B 5A 5C  ...Hf.m....G..Z\
0040: 73 FC AE D9 1B 32 19 38   AB 97 34 14 AA 96 D2 EB  s....2.8..4.....
0050: A3 1C 14 08 49 B6 BB E5   91 EF 83 36 EB 1D 56 6F  ....I......6..Vo
0060: CA DA BC 73 63 90 E4 7F   7B 3E 22 CB 3D 07 ED 5F  ...sc....>".=.._
0070: 38 74 9C E3 03 50 4E A1   AF 98 EE 61 F2 84 3F 12  8t...PN....a..?.

]
***
Found trusted certificate:
[
[
  Version: V3
  Subject: CN=*.google.com, O=Google Inc, L=Mountain View, ST=California, C=US
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11

  Key:  Sun EC public key, 256 bits
  public x coord: 15857649762105096772968051547638456909892305426137858367128632380206196964288
  public y coord: 48779184071160655230510496126717706041261646117444654293733038245412446736917
  parameters: secp256r1 [NIST P-256, X9.62 prime256v1] (1.2.840.10045.3.1.7)
  Validity: [From: Wed Apr 12 22:37:30 JST 2017,
               To: Wed Jul 05 22:28:00 JST 2017]
  Issuer: CN=Google Internet Authority G2, O=Google Inc, C=US
  SerialNumber: [    4fca07b9 59375f08]

Certificate Extensions: 9
[1]: ObjectId: 1.3.6.1.5.5.7.1.1 Criticality=false
AuthorityInfoAccess [
  [
   accessMethod: caIssuers
   accessLocation: URIName: http://pki.google.com/GIAG2.crt
,
   accessMethod: ocsp
   accessLocation: URIName: http://clients1.google.com/ocsp
]
]

[2]: ObjectId: 2.5.29.35 Criticality=false
AuthorityKeyIdentifier [
KeyIdentifier [
0000: 4A DD 06 16 1B BC F6 68   B5 76 F5 81 B6 BB 62 1A  J......h.v....b.
0010: BA 5A 81 2F                                        .Z./
]
]

[3]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
  CA:false
  PathLen: undefined
]

[4]: ObjectId: 2.5.29.31 Criticality=false
CRLDistributionPoints [
  [DistributionPoint:
     [URIName: http://pki.google.com/GIAG2.crl]
]]

[5]: ObjectId: 2.5.29.32 Criticality=false
CertificatePolicies [
  [CertificatePolicyId: [1.3.6.1.4.1.11129.2.5.1]
[]  ]
  [CertificatePolicyId: [2.23.140.1.2.2]
[]  ]
]

[6]: ObjectId: 2.5.29.37 Criticality=false
ExtendedKeyUsages [
  serverAuth
  clientAuth
]

[7]: ObjectId: 2.5.29.15 Criticality=false
KeyUsage [
  DigitalSignature
]

[8]: ObjectId: 2.5.29.17 Criticality=false
SubjectAlternativeName [
  DNSName: *.google.com
  DNSName: *.android.com
  DNSName: *.appengine.google.com
  DNSName: *.cloud.google.com
  DNSName: *.gcp.gvt2.com
  DNSName: *.google-analytics.com
  DNSName: *.google.ca
  DNSName: *.google.cl
  DNSName: *.google.co.in
  DNSName: *.google.co.jp
  DNSName: *.google.co.uk
  DNSName: *.google.com.ar
  DNSName: *.google.com.au
  DNSName: *.google.com.br
  DNSName: *.google.com.co
  DNSName: *.google.com.mx
  DNSName: *.google.com.tr
  DNSName: *.google.com.vn
  DNSName: *.google.de
  DNSName: *.google.es
  DNSName: *.google.fr
  DNSName: *.google.hu
  DNSName: *.google.it
  DNSName: *.google.nl
  DNSName: *.google.pl
  DNSName: *.google.pt
  DNSName: *.googleadapis.com
  DNSName: *.googleapis.cn
  DNSName: *.googlecommerce.com
  DNSName: *.googlevideo.com
  DNSName: *.gstatic.cn
  DNSName: *.gstatic.com
  DNSName: *.gvt1.com
  DNSName: *.gvt2.com
  DNSName: *.metric.gstatic.com
  DNSName: *.urchin.com
  DNSName: *.url.google.com
  DNSName: *.youtube-nocookie.com
  DNSName: *.youtube.com
  DNSName: *.youtubeeducation.com
  DNSName: *.ytimg.com
  DNSName: android.clients.google.com
  DNSName: android.com
  DNSName: developer.android.google.cn
  DNSName: developers.android.google.cn
  DNSName: g.co
  DNSName: goo.gl
  DNSName: google-analytics.com
  DNSName: google.com
  DNSName: googlecommerce.com
  DNSName: source.android.google.cn
  DNSName: urchin.com
  DNSName: www.goo.gl
  DNSName: youtu.be
  DNSName: youtube.com
  DNSName: youtubeeducation.com
]

[9]: ObjectId: 2.5.29.14 Criticality=false
SubjectKeyIdentifier [
KeyIdentifier [
0000: C7 C2 3E 01 A4 D3 F4 4E   DE 59 7F 98 31 7D C0 8B  ..>....N.Y..1...
0010: 88 C5 1D 9A                                        ....
]
]

]
  Algorithm: [SHA256withRSA]
  Signature:
0000: 61 F7 94 99 58 C7 7A AD   99 45 F7 C9 43 0C 6E 8C  a...X.z..E..C.n.
0010: 1A D8 0C 7C 96 51 29 B8   01 1B 2D FB C4 E8 AB BA  .....Q)...-.....
0020: AC C0 B0 69 49 3A 8C 81   67 3C 3D 74 0D 0B E5 0D  ...iI:..g<=t....
0030: 98 04 32 AB 52 CA D1 1E   BD 9A 24 43 99 AB 33 B7  ..2.R.....$C..3.
0040: A3 77 1E 2B 4E FB 47 0E   F3 2E 44 58 2B 2F EE B3  .w.+N.G...DX+/..
0050: AB 9F ED E4 D6 37 9B CC   42 13 53 18 4D EB 57 29  .....7..B.S.M.W)
0060: 71 FF 2E 3D 79 28 0A C3   30 36 DF C0 A2 59 CB 4D  q..=y(..06...Y.M
0070: 69 74 A3 94 4E 64 A0 D0   B5 55 22 B2 80 3E 2F 4A  it..Nd...U"..>/J
0080: 25 15 49 57 35 3D 84 26   C6 3A F6 67 38 BE F1 49  %.IW5=.&.:.g8..I
0090: 35 01 17 D4 A7 A2 35 A3   D6 9E D8 2A 15 FD EA E5  5.....5....*....
00A0: 88 34 69 C2 D9 F6 07 9F   6C CD 7A 60 1E 28 E3 E8  .4i.....l.z`.(..
00B0: E3 3B FA 7A 19 89 BA 43   0C F9 2A C1 61 9F 80 DA  .;.z...C..*.a...
00C0: C2 0A 61 E9 C0 31 64 DC   F0 C1 3C 01 E5 83 A8 89  ..a..1d...<.....
00D0: 79 43 23 48 88 FB E6 8C   08 0E E1 1E 51 5F F1 C5  yC#H........Q_..
00E0: 11 49 C0 E6 F3 E8 2D 30   E6 8B 26 CE F9 55 83 C8  .I....-0..&..U..
00F0: F2 B2 B6 C6 E8 4E 53 D6   E6 D5 F8 B2 F8 C3 23 61  .....NS.......#a

]
main, READ: TLSv1.2 Handshake, length = 148
*** ECDH ServerKeyExchange
Signature Algorithm SHA256withECDSA
Server key: Sun EC public key, 256 bits
  public x coord: 115756770858964201123508282005285098276280732187879456334366788861687300357561
  public y coord: 110353450491050068374662283797391955503928196866475776828795242660392251194224
  parameters: secp256r1 [NIST P-256, X9.62 prime256v1] (1.2.840.10045.3.1.7)
main, READ: TLSv1.2 Handshake, length = 4
*** ServerHelloDone
*** ECDHClientKeyExchange
ECDH Public value:  { 4, 102, 16, 232, 95, 167, 218, 53, 177, 237, 93, 245, 96, 45, 22, 128, 103, 51, 27, 241, 225, 92, 68, 168, 164, 61, 229, 90, 224, 170, 94, 68, 26, 134, 158, 1, 78, 48, 106, 73, 192, 50, 212, 221, 185, 2, 236, 60, 27, 155, 31, 97, 14, 172, 185, 8, 39, 226, 197, 109, 10, 88, 187, 197, 78 }
main, WRITE: TLSv1.2 Handshake, length = 70
SESSION KEYGEN:
PreMaster Secret:
0000: 32 88 BD EA 48 29 4F D3   29 4D A5 3E E9 C8 92 9C  2...H)O.)M.>....
0010: E5 C9 FC 2D B7 8B 6C 74   60 0B F3 BB 2A 91 FD 08  ...-..lt`...*...
CONNECTION KEYGEN:
Client Nonce:
0000: 59 03 13 E3 D3 A5 79 56   FC 07 76 44 09 10 9E 50  Y.....yV..vD...P
0010: F4 74 32 84 EB 03 7C AE   B6 FE CE B5 49 4E 98 88  .t2.........IN..
Server Nonce:
0000: 59 03 13 E2 44 3E 47 76   54 A1 48 16 BB 41 AB 49  Y...D>GvT.H..A.I
0010: 75 C7 31 3F 6E 6F A6 E3   CC E2 7E 33 D0 23 BD DB  u.1?no.....3.#..
Master Secret:
0000: D5 66 F7 91 0F 75 F3 1E   2E 08 F6 14 8F 44 27 6F  .f...u.......D'o
0010: 2C C1 A2 72 10 10 72 64   E6 9C E0 1A E4 57 EB 4A  ,..r..rd.....W.J
0020: 2C AF 60 A9 8D A8 C4 A8   75 7D 87 77 5A 22 AB 23  ,.`.....u..wZ".#
... no MAC keys used for this cipher
Client write key:
0000: D7 F8 D2 DC FD 2A F5 9B   1B B8 47 68 63 E1 41 75  .....*....Ghc.Au
Server write key:
0000: 59 80 39 DA 17 09 04 69   0A 80 C3 4C 50 2A AF 8C  Y.9....i...LP*..
Client write IV:
0000: 79 2D 4F 89                                        y-O.
Server write IV:
0000: E0 94 B0 12                                        ....
main, WRITE: TLSv1.2 Change Cipher Spec, length = 1
*** Finished
verify_data:  { 107, 89, 71, 14, 131, 49, 61, 251, 37, 136, 64, 119 }
***
main, WRITE: TLSv1.2 Handshake, length = 40
main, READ: TLSv1.2 Change Cipher Spec, length = 1
main, READ: TLSv1.2 Handshake, length = 40
*** Finished
verify_data:  { 46, 135, 143, 56, 123, 58, 143, 124, 90, 252, 201, 121 }
***
%% Cached client session: [Session-1, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256]
main, WRITE: TLSv1.2 Application Data, length = 25
Successfully connected

無事接続できました。

まとめ

JKSを利用したSSL接続では意外とハマることが多いので、
ハンドシェイクまで見ていくと問題解決の道筋が見えてきます。