Re: "No subject alternative names matching IP address" error with 1.64
Mauro Molinari <[email protected]> Mon, 11 Nov 2019 19:01:13 +0100
| Newsgroups | gmane.comp.encryption.bouncy-castle.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format.
--------------29ABF4985C5213262BB272AB
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: 8bit
Hi Bernd,
I'm using this within a Spring Integration flow. What I see that is
performed is this:
* connection = url.openConnection()
* this connection is a HttpsUrlConnection on which I set my custom
SSLSocketFactory with
javax.net.ssl.HttpsURLConnection.setSSLSocketFactory(SSLSocketFactory)
* then, the following properties are set on the connection before use:
|connection.setRequestMethod(HttpTransportConstants.METHOD_POST);
connection.setUseCaches(false);
connection.setDoInput(true);
connection.setDoOutput(true);
if (isAcceptGzipEncoding()) {
connection.setRequestProperty(HttpTransportConstants.HEADER_ACCEPT_ENCODING,
HttpTransportConstants.CONTENT_ENCODING_GZIP);
}
connection.setConnectTimeout(myConnectTimeout);
connection.setReadTimeout(myReadTimeout);
|
I use a custom SSLSocketFactory in order to be able to supply a client
certificate. This SSLSocketFactory is built by this method:
|public static SSLSocketFactory createClientCertificateSslSocketFactory(
final InputStream clientCertificateArchiveInputStream,
final char[] clientCertificateArchivePassword,
final Provider provider) throws IOException, CertificateException,
UnrecoverableKeyException {
final KeyManagerFactory keyManagerFactory;
try {
keyManagerFactory = KeyManagerFactory.getInstance("SunX509");
final KeyStore keyStore;
try {
keyStore = KeyStore.getInstance("PKCS12");
} catch (KeyStoreException e) {
// no PKCS12 provider - should never happen
throw new RuntimeException(e);
}
keyStore.load(clientCertificateArchiveInputStream,
clientCertificateArchivePassword);
try {
keyManagerFactory.init(keyStore,
clientCertificateArchivePassword);
} catch (KeyStoreException e) {
// we do not expect this to happen
throw new RuntimeException(e);
}
final SSLContext context = provider != null
? SSLContext.getInstance("TLS", provider)
: SSLContext.getInstance("TLS");
try {
context.init(keyManagerFactory.getKeyManagers(), null,
new SecureRandom());
} catch (KeyManagementException e) {
// another unexpected failures
throw new RuntimeException(e);
}
return context.getSocketFactory();
} catch (final NoSuchAlgorithmException e) {
// missing or problematic SunX509 provider - should never happen
throw new RuntimeException(e);
}
}|
|
|
The supplied provider, in my case, is a: |new BouncyCastleJsseProvider()|
So, apart from supplying the BC provider and the key managers to the
SSLContext from which the SSL socket factory is retrieved, I don't do
anything else.
Mauro
Il 11/11/2019 17:49, Eckenfels. Bernd ha scritto:
> If you supply your own ConnectionFactory maybe this one does incorrectly construct the SSLSocket and uses the resolved address instead of the hostname. This will influence the SNI Signalling and the HostnameVerifier.
>
> Gruss
> Bernd
> --
> http://www.seeburger.com
--------------29ABF4985C5213262BB272AB
Content-Type: text/html; charset=utf-8
Content-Transfer-Encoding: 8bit
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi Bernd,</div>
<div class="moz-cite-prefix">I'm using this within a Spring
Integration flow. What I see that is performed is this:</div>
<div class="moz-cite-prefix">
<ul>
<li>connection = url.openConnection()</li>
<li>this connection is a HttpsUrlConnection on which I set my
custom SSLSocketFactory with
javax.net.ssl.HttpsURLConnection.setSSLSocketFactory(SSLSocketFactory)</li>
<li>then, the following properties are set on the connection
before use:<br>
<code>connection.setRequestMethod(HttpTransportConstants.METHOD_POST);<br>
connection.setUseCaches(false);<br>
connection.setDoInput(true);<br>
connection.setDoOutput(true);<br>
if (isAcceptGzipEncoding()) {<br>
connection.setRequestProperty(HttpTransportConstants.HEADER_ACCEPT_ENCODING,<br>
HttpTransportConstants.CONTENT_ENCODING_GZIP);<br>
}<br>
connection.setConnectTimeout(myConnectTimeout);<br>
connection.setReadTimeout(myReadTimeout);<br>
</code></li>
</ul>
</div>
<div class="moz-cite-prefix">I use a custom SSLSocketFactory in
order to be able to supply a client certificate. This
SSLSocketFactory is built by this method:</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix"><code>public static SSLSocketFactory
createClientCertificateSslSocketFactory(<br>
final InputStream clientCertificateArchiveInputStream,<br>
final char[] clientCertificateArchivePassword,<br>
final Provider provider) throws IOException,
CertificateException,<br>
UnrecoverableKeyException {<br>
final KeyManagerFactory keyManagerFactory;<br>
try {<br>
keyManagerFactory =
KeyManagerFactory.getInstance("SunX509");<br>
final KeyStore keyStore;<br>
try {<br>
keyStore = KeyStore.getInstance("PKCS12");<br>
} catch (KeyStoreException e) {<br>
// no PKCS12 provider - should never happen<br>
throw new RuntimeException(e);<br>
}<br>
keyStore.load(clientCertificateArchiveInputStream,<br>
clientCertificateArchivePassword);<br>
try {<br>
keyManagerFactory.init(keyStore,<br>
clientCertificateArchivePassword);<br>
} catch (KeyStoreException e) {<br>
// we do not expect this to happen<br>
throw new RuntimeException(e);<br>
}<br>
final SSLContext context = provider != null<br>
? SSLContext.getInstance("TLS", provider)<br>
: SSLContext.getInstance("TLS");<br>
try {<br>
context.init(keyManagerFactory.getKeyManagers(),
null,<br>
new SecureRandom());<br>
} catch (KeyManagementException e) {<br>
// another unexpected failures<br>
throw new RuntimeException(e);<br>
}<br>
return context.getSocketFactory();<br>
} catch (final NoSuchAlgorithmException e) {<br>
// missing or problematic SunX509 provider - should
never happen<br>
throw new RuntimeException(e);<br>
}<br>
}</code></div>
<div class="moz-cite-prefix"><code><br>
</code></div>
<div class="moz-cite-prefix">The supplied provider, in my case, is
a: <code>new BouncyCastleJsseProvider()</code></div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">So, apart from supplying the BC
provider and the key managers to the SSLContext from which the SSL
socket factory is retrieved, I don't do anything else.</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Mauro<br>
</div>
<div class="moz-cite-prefix"><br>
</div>
<div class="moz-cite-prefix">Il 11/11/2019 17:49, Eckenfels. Bernd
ha scritto:<br>
</div>
<blockquote type="cite"
cite="mid:ED12D06EC205E3458FC3E23CD84D4ED502552B275B-eS2ujU6r4+tY/[email protected]">
<pre class="moz-quote-pre" wrap="">If you supply your own ConnectionFactory maybe this one does incorrectly construct the SSLSocket and uses the resolved address instead of the hostname. This will influence the SNI Signalling and the HostnameVerifier.
Gruss
Bernd
--
<a class="moz-txt-link-freetext" href="http://www.seeburger.com">http://www.seeburger.com</a>
</pre>
</blockquote>
<br>
</body>
</html>
--------------29ABF4985C5213262BB272AB--