[
https://issues.apache.org/jira/browse/HTTPCLIENT-2247?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17632639#comment-17632639
]
Oleg Kalnichevski commented on HTTPCLIENT-2247:
-----------------------------------------------
The pattern *{*}.compute-1.amazonaws.com{*} is present in the Public Suffix
List [1]. Therefore I have to assume *ec2.compute-1.amazonaws.com* is expected
to represent a domain, not a host.
*somehost.ec2.compute-1.amazonaws.com* should match the pattern but
*ec2.compute-1.amazonaws.com* should not because It is not a host.
Oleg
[1] [https://publicsuffix.org/list/public_suffix_list.dat]
> SSLPeerUnverifiedException on matching wildcard certificate (US20 amazon)
> -------------------------------------------------------------------------
>
> Key: HTTPCLIENT-2247
> URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2247
> Project: HttpComponents HttpClient
> Issue Type: Bug
> Components: HttpClient (classic)
> Affects Versions: 4.5.13
> Reporter: fan2
> Priority: Major
> Fix For: 4.5.14, 5.1.4, 5.2.1
>
>
> In version 4.5.13, the following code piece will throw
> SSLPeerUnverifiedException. If the host change to
> "ec2.us-east-1.compute-1.amazonaws.com" and DNS change to
> "*.us-east-1.compute-1.amazonaws.com", then the exception is gone.
>
> {code:java}
> List<SubjectName> subjectAlts = new ArrayList<>();
> PublicSuffixMatcher publicSuffixMatcher =
> PublicSuffixMatcherLoader.getDefault();
> // assume a certificate with multiple SANs, some of which might contain
> wildcards
> String host = "ec2.compute-1.amazonaws.com";
> subjectAlts.add(SubjectName.DNS("*.compute-1.amazonaws.com"));
> try {
> DefaultHostnameVerifier.matchDNSName(host, subjectAlts, publicSuffixMatcher);
> }
> catch (Exception e) {
> System.out.println(e);
> }
> {code}
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
