[
https://issues.apache.org/jira/browse/HADOOP-19959?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126636#comment-18126636
]
Siyao Meng commented on HADOOP-19959:
-------------------------------------
Every user of SSLHostnameVerifier goes through HttpsURLConnection, where the
JDK matches IP subject alternative names before this verifier is consulted, so
certificates with IP SANs already verify for IPv4 and IPv6 literals.
Closing as not needed.
> Support IP subject alternative names in SSLHostnameVerifier
> -----------------------------------------------------------
>
> Key: HADOOP-19959
> URL: https://issues.apache.org/jira/browse/HADOOP-19959
> Project: Hadoop Common
> Issue Type: Sub-task
> Reporter: Siyao Meng
> Assignee: Siyao Meng
> Priority: Major
>
> SSLHostnameVerifier reads only DNS subject alternative names. It cannot
> verify a URL that uses an IPv4 or IPv6 literal. Read X.509 IP address subject
> alternative names. Normalize bracketed IPv6 hosts and equivalent IPv6 forms.
> Do not match an IP address through a DNS name or common name.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
