You are viewing a plain text version of this content. The canonical link for it is here.

Posted to common-issues@hadoop.apache.org by "Siyao Meng (Jira)" <ji...@apache.org> on 2026/10/13 08:18:00 UTC

[jira] [Commented] (HADOOP-19959) Support IP subject alternative names in SSLHostnameVerifier

    [ https://issues.apache.org/jira/browse/HADOOP-19959?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18126636#comment-18126636 ] 

Siyao Meng commented on HADOOP-19959:
-------------------------------------

Every user of SSLHostnameVerifier goes through HttpsURLConnection, where the JDK matches IP subject alternative names before this verifier is consulted, so certificates with IP SANs already verify for IPv4 and IPv6 literals.

Closing as not needed.

> Support IP subject alternative names in SSLHostnameVerifier
> -----------------------------------------------------------
>
>                 Key: HADOOP-19959
>                 URL: https://issues.apache.org/jira/browse/HADOOP-19959
>             Project: Hadoop Common
>          Issue Type: Sub-task
>            Reporter: Siyao Meng
>            Assignee: Siyao Meng
>            Priority: Major
>
> SSLHostnameVerifier reads only DNS subject alternative names. It cannot verify a URL that uses an IPv4 or IPv6 literal. Read X.509 IP address subject alternative names. Normalize bracketed IPv6 hosts and equivalent IPv6 forms. Do not match an IP address through a DNS name or common name.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org