Torsten Mielke created CAMEL-24379:
--------------------------------------
Summary: AS2 client ignores custom HostnameVerifier due to
JSSE-level hostname verification
Key: CAMEL-24379
URL: https://issues.apache.org/jira/browse/CAMEL-24379
Project: Camel
Issue Type: Bug
Components: camel-as2
Affects Versions: 4.22.0
Reporter: Torsten Mielke
When configuring a custom {{HostnameVerifier}} (e.g.,
{{{}NoopHostnameVerifier{}}}) on an AS2 endpoint, the verifier is silently
ignored. Connections to servers whose TLS certificate CN/SAN doesn't match the
hostname fail with:
{{SSLHandshakeException: No name matching <hostname> found}}
h4. Root cause:
In {{{}AS2ClientConnection{}}}, the {{DefaultClientTlsStrategy}} is created as:
{{ tlsStrategy = new DefaultClientTlsStrategy(sslContext, hostnameVerifier);}}
This constructor defaults to {{{}HostnameVerificationPolicy.BOTH{}}}, which
sets {{endpointIdentificationAlgorithm("HTTPS")}} on the SSLParameters before
the TLS handshake.
This triggers the JDK's built-in hostname verification inside
{{X509TrustManagerImpl.checkIdentity()}} during the handshake — before the
custom HostnameVerifier ever runs. Since the JSSE check rejects the connection,
the custom verifier is never invoked.
h4. Fix:
Use {{HostnameVerificationPolicy.CLIENT}} when a custom HostnameVerifier is
provided, so that hostname verification is delegated entirely to the provided
verifier.
{code:java}
tlsStrategy = new DefaultClientTlsStrategy(sslContext,
HostnameVerificationPolicy.CLIENT, hostnameVerifier);
{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
