You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by "Oleg Kalnichevski (Jira)" <ji...@apache.org> on 2022/11/12 09:44:00 UTC
[jira] [Comment Edited] (HTTPCLIENT-2247) SSLPeerUnverifiedException on matching wildcard certificate (US20 amazon)
[ https://issues.apache.org/jira/browse/HTTPCLIENT-2247?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17632639#comment-17632639 ]
Oleg Kalnichevski edited comment on HTTPCLIENT-2247 at 11/12/22 9:43 AM:
-------------------------------------------------------------------------
The pattern *\*.compute-1.amazonaws.com* is present in the Public Suffix List [1]. Therefore I have to assume *ec2.compute-1.amazonaws.com* is expected to represent a domain, not a host.
*somehost.ec2.compute-1.amazonaws.com* should match the pattern but *ec2.compute-1.amazonaws.com* should not because It is not a host.
Oleg
[1] [https://publicsuffix.org/list/public_suffix_list.dat]
was (Author: olegk):
The pattern *{*}.compute-1.amazonaws.com{*} is present in the Public Suffix List [1]. Therefore I have to assume *ec2.compute-1.amazonaws.com* is expected to represent a domain, not a host.
*somehost.ec2.compute-1.amazonaws.com* should match the pattern but *ec2.compute-1.amazonaws.com* should not because It is not a host.
Oleg
[1] [https://publicsuffix.org/list/public_suffix_list.dat]
> SSLPeerUnverifiedException on matching wildcard certificate (US20 amazon)
> -------------------------------------------------------------------------
>
> Key: HTTPCLIENT-2247
> URL: https://issues.apache.org/jira/browse/HTTPCLIENT-2247
> Project: HttpComponents HttpClient
> Issue Type: Bug
> Components: HttpClient (classic)
> Affects Versions: 4.5.13
> Reporter: fan2
> Priority: Major
> Fix For: 4.5.14, 5.1.4, 5.2.1
>
>
> In version 4.5.13, the following code piece will throw SSLPeerUnverifiedException. If the host change to "ec2.us-east-1.compute-1.amazonaws.com" and DNS change to "*.us-east-1.compute-1.amazonaws.com", then the exception is gone.
>
> {code:java}
> List<SubjectName> subjectAlts = new ArrayList<>();
> PublicSuffixMatcher publicSuffixMatcher = PublicSuffixMatcherLoader.getDefault();
> // assume a certificate with multiple SANs, some of which might contain wildcards
> String host = "ec2.compute-1.amazonaws.com";
> subjectAlts.add(SubjectName.DNS("*.compute-1.amazonaws.com"));
> try {
> DefaultHostnameVerifier.matchDNSName(host, subjectAlts, publicSuffixMatcher);
> }
> catch (Exception e) {
> System.out.println(e);
> }
> {code}
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@hc.apache.org
For additional commands, e-mail: dev-help@hc.apache.org