You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tomcat.apache.org by bu...@apache.org on 2025/06/25 21:43:20 UTC
[Bug 69728] New: TLS with H2 - Weird log - Confusion between optional client certificate and optional verification?
https://bz.apache.org/bugzilla/show_bug.cgi?id=69728
Bug ID: 69728
Summary: TLS with H2 - Weird log - Confusion between optional
client certificate and optional verification?
Product: Tomcat 10
Version: 10.1.31
Hardware: PC
OS: Linux
Status: NEW
Severity: normal
Priority: P2
Component: Connectors
Assignee: dev@tomcat.apache.org
Reporter: bugzilla@gdarmont.fr
Target Milestone: ------
Hey Tomcat team!
Something looks unclear in the TLS client certificate handling in Tomcat.
Our Spring Boot application is configured with HTTP/2 and optional client
certificate, through Spring Boot property "ssl.clientAuth = WANT".
This property is mapped to Tomcat's "CertificateVerification.OPTIONAL".
Our need is quite simple:
* if a new connection presents a TLS client certificate, we need to validate
it. If certificate is valid, connection is established and client is
authenticated.
* if a new connection does not have a TLS client certificate, connection is
established and client is anonymous.
Note that everything is working fine.
But the problem is that when the application starts, we have this warning log:
"The TLS virtual host [...] is configured for optional certificate verification
and the enclosing connector is configured to support upgrade to h2. HTTP/2 over
TLS does not permit optional certificate verification."
And this log looks wrong, because we don't ask for optional verification, we
ask for optional client certificate presence. If the certificate is present, we
do want to validate it.
My understanding is that there's 2 level of optional -optional certificate and
optional verification- sometimes merged into only one.
Am I missing something here?
Guillaume
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69728] TLS with H2 - Weird log - Confusion between optional client certificate and optional verification?
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69728
Mark Thomas <ma...@apache.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #3 from Mark Thomas <ma...@apache.org> ---
Fixed in:
- 11.0.x for 11.0.9 onwards
- 10.1.x for 10.1.43 onwards
- 9.0.x for 9.0.107 onwards
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69728] TLS with H2 - Weird log - Confusion between optional client certificate and optional verification?
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69728
--- Comment #1 from Mark Thomas <ma...@apache.org> ---
Optional verification and optional presence are the same thing.
That said, I do think the log message isn't quite right.
The issue is the HTTP/2 doesn't permit re-handshaking (TLS 1.2) or
post-handshake authentication (PHA - TLS 1.3). That causes problems if
CLIENT-CERT authentication is used since it triggers a rehandshake/PHA to
obtain a client certificate if one is not present when the user requests a
protected URI.
If certificateVerification is set to required - everything will be fine. If
certificateVerification is set to anything else then there might be problems
depending on if the client provides a certificate with the initial connection
and if the client requests a protected resource.
I'll look at re-working when that warning is displayed and the text of the
warning.
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org
[Bug 69728] TLS with H2 - Weird log - Confusion between optional client certificate and optional verification?
Posted by bu...@apache.org.
https://bz.apache.org/bugzilla/show_bug.cgi?id=69728
--- Comment #2 from Guillaume Darmont <bu...@gdarmont.fr> ---
Ok I see now.
Thanks for your answer, and having a look at the log.
Guillaume
--
You are receiving this mail because:
You are the assignee for the bug.
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tomcat.apache.org
For additional commands, e-mail: dev-help@tomcat.apache.org