orangeCatDeveloper opened a new pull request, #4324:
URL: https://github.com/apache/hertzbeat/pull/4324
Fixes #1132
With "verify certificate" switched off, the ssl_cert monitor still fails
against self-signed sites reached by IP or with a CN/SAN mismatch, so their
certificates cannot be monitored at all.
Root cause: disabling verify only installs a trust-all `SSLContext`, which
skips chain validation — but `HttpsURLConnection`'s default `HostnameVerifier`
still runs and rejects the connection:
```
No subject alternative names matching IP address 127.0.0.1 found
```
The fix completes the verify-off path: alongside the existing trust-all
socket factory, install a permissive `HostnameVerifier` so both TLS checks
(chain + hostname) are skipped. The verify-on path is untouched — the issue's
`PKIX path building failed` with verify on is correct behavior for an untrusted
cert, not part of this fix.
The test replaces the empty `SslCertificateCollectImplTest` stub: it starts
a local `HttpsServer` with a keytool-generated self-signed cert whose SAN
deliberately mismatches the target, covering both failure modes in one
handshake.
Before / after (same test, fix reverted vs applied):
```
before: verify-off FAIL — No subject alternative names matching IP address
127.0.0.1 found
after: verify-off cert collected — rows=1 [CN=test, false, <end_timestamp>]
verify-on unchanged — UN_CONNECTABLE, PKIX path building failed
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
