[jira] [Created] (HTTPCLIENT-2055) Verification of certificates containing wildcard SANs fails to non-public domains

["Wolfgang Schell (Jira)" <ji...@apache.org>]

Wolfgang Schell created HTTPCLIENT-2055:
-------------------------------------------

             Summary: Verification of certificates containing wildcard SANs fails to non-public domains
                 Key: HTTPCLIENT-2055
                 URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2055
             Project: HttpComponents HttpClient
          Issue Type: Bug
    Affects Versions: 4.5.11, 4.5.9
            Reporter: Wolfgang Schell


This case is very similar to HTTPCLIENT-1997:

Using a certificate containing wildcard domain names as subject alternative name (SAN) for non-public domains (i.e. something like a {{.mycorp}} TLD) fails in some versions of HttpClient:

 

The following (JUnit 4) test case demonstrates the issue:
{code:java}
package org.apache.http.conn.ssl;

import static org.junit.Assert.fail;
import java.util.ArrayList;
import java.util.List;
import org.apache.http.conn.util.PublicSuffixMatcher;
import org.apache.http.conn.util.PublicSuffixMatcherLoader;
import org.junit.Test;


public class CertificateTest {
    @Test
    public void testSubjectAlternativeNames_WithWildcards() throws Exception {
        List<SubjectName> subjectAlts = new ArrayList<>();
        PublicSuffixMatcher publicSuffixMatcher = PublicSuffixMatcherLoader.getDefault();

        // assume a certificate with multiple SANs, some of which might contain wildcards
        String host = "my-service-http.apps.system.mycorp";
        subjectAlts.add(SubjectName.DNS("apps.system.mycorp"));
        subjectAlts.add(SubjectName.DNS("*.apps.system.mycorp"));
        try {
            DefaultHostnameVerifier.matchDNSName(host, subjectAlts, publicSuffixMatcher);
        }
        catch (Exception e) {
            fail("verification failed: " + e.getMessage());
        }
    }
} {code}
 

Here is the result for various HttpClient versions:

4.5.9: fail
 4.5.10: success (fix by HTTPCLIENT-1997)
 4.5.11: fail (broken by HTTPCLIENT-2030)
  

With the 4.5.11 code base I'm wondering why {{DefaultHostnameVerifier.matchDNSName()}} would assume that this is a ICANN (i.e. public) domain.

Passing {{DomainType.UNKNOWN}} instead of {{DomainType.ICANN}} to {{matchIdentityStrict()}} solves this issue (but I'm not sure if that has other issue elsewhere in the code).

 A workaround is to add the private domain name {{mycorp}} to resource {{/mozilla/public-suffix-list.txt}} on the classpath (the default version of which is provided by HttpClient). This is tricky to solve, though, as one has to make sure to have the modified version in the classpath before {{httpclient-<version>.jar}}.

 



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org