[
https://issues.apache.org/jira/browse/CAMEL-24379?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Torsten Mielke reassigned CAMEL-24379:
--------------------------------------
Assignee: Torsten Mielke
> AS2 client ignores custom HostnameVerifier due to JSSE-level hostname
> verification
> ----------------------------------------------------------------------------------
>
> Key: CAMEL-24379
> URL: https://issues.apache.org/jira/browse/CAMEL-24379
> Project: Camel
> Issue Type: Bug
> Components: camel-as2
> Affects Versions: 4.22.0
> Reporter: Torsten Mielke
> Assignee: Torsten Mielke
> Priority: Major
>
> When configuring a custom {{HostnameVerifier}} (e.g.,
> {{{}NoopHostnameVerifier{}}}) on an AS2 endpoint, the verifier is silently
> ignored. Connections to servers whose TLS certificate CN/SAN doesn't match
> the hostname fail with:
> {{SSLHandshakeException: No name matching <hostname> found}}
> h4. Root cause:
> In {{{}AS2ClientConnection{}}}, the {{DefaultClientTlsStrategy}} is created
> as:
> {{ tlsStrategy = new DefaultClientTlsStrategy(sslContext,
> hostnameVerifier);}}
> This constructor defaults to {{{}HostnameVerificationPolicy.BOTH{}}}, which
> sets {{endpointIdentificationAlgorithm("HTTPS")}} on the SSLParameters before
> the TLS handshake.
> This triggers the JDK's built-in hostname verification inside
> {{X509TrustManagerImpl.checkIdentity()}} during the handshake — before the
> custom HostnameVerifier ever runs. Since the JSSE check rejects the
> connection, the custom verifier is never invoked.
> h4. Fix:
> Use {{HostnameVerificationPolicy.CLIENT}} when a custom HostnameVerifier is
> provided, so that hostname verification is delegated entirely to the provided
> verifier.
>
> {code:java}
> tlsStrategy = new DefaultClientTlsStrategy(sslContext,
> HostnameVerificationPolicy.CLIENT, hostnameVerifier);
> {code}
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
