You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2019/10/30 17:22:59 UTC
[Bug 63894] New: SLHostConfig certificateVerification="optionalNoCA"
certificateVerificationDepth="6" doesn't work
https://bz.apache.org/bugzilla/show_bug.cgi?id=63894
Bug ID: 63894
Summary: SLHostConfig certificateVerification="optionalNoCA"
certificateVerificationDepth="6" doesn't work
Product: Tomcat 9
Version: 9.0.x
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: jfclere@gmail.com
Target Milestone: -----
When trying to set certificateVerification="optionalNoCA"
certificateVerificationDepth="6" in SSLHostConfig I have noted that
verification is always 2 and the depth 10.
Basically I printed it in SSL_callback_SSL_verify() in native/src/sslutils.c
and I don't get the optionalNoCA nor 6.
According to my traces:
In sslcontext.c setVerify level 3 depth 6
In SSL.c setVerify Level: 1 DeptH: 10
In SSL.c setVerify Level: 1 DeptH: 10
So the value is set properly and later overwritten twice :-(
My configuration is:
<Connector port="8443" protocol="HTTP/1.1"
maxThreads="150" SSLEnabled="true">
<SSLHostConfig certificateVerification="optionalNoCA"
certificateVerificationDepth="6" caCertificateFile="/etc/pki/CA/cacert.pem">
<Certificate
certificateKeyFile="/home/jfclere/NOTES/APACHECONNA2019/httpdssl/jfcpc_newkey.pem"
certificateFile="/home/jfclere/NOTES/APACHECONNA2019/httpdssl/jfcpc_newcert.pem"
certificateKeyPassword="adelina"
type="RSA" />
</SSLHostConfig>
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 63894] SLHostConfig certificateVerification="optionalNoCA"
certificateVerificationDepth="6" doesn't work
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63894
--- Comment #2 from Mark Thomas <ma...@apache.org> ---
Note to self: optionalNoCA always fails if OCSP is enabled which it is by
default in most OpenSSL builds.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 63894] SLHostConfig certificateVerification="optionalNoCA"
certificateVerificationDepth="6" doesn't work
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63894
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Resolution|--- |FIXED
Status|NEW |RESOLVED
--- Comment #3 from Mark Thomas <ma...@apache.org> ---
Patch confirmed.
I addressed the issue of the multiple calls to setVerify in SSL.c in a separate
commit.
Fixed in:
- master for 9.0.28 onwards
- 8.5.x for 8.5.48 onwards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 63894] SLHostConfig certificateVerification="optionalNoCA"
certificateVerificationDepth="6" doesn't work
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=63894
--- Comment #1 from Remy Maucherat <re...@apache.org> ---
Created attachment 36866
--> https://bz.apache.org/bugzilla/attachment.cgi?id=36866&action=edit
Test patch
The OpenSSL style doesn't work well with the JSSE style configuration on engine
creation. Also optionalNoCA doesn't mean much since JSSE always has a
truststore. So trying to pass the two parameters and see how it works, I didn't
test it though.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org