[https/ssl] - CN verification: setAllowedNames() idea

[Julius Davies <ju...@gmail.com>]

Hi,

Cross-posting is evil.  I know!  But
"not-yet-commons-ssl@lists.juliusdavies.ca" only has six subscribers,
so I thought I'd try this by a slightly larger audience.

Here's the idea:


/**
 * Offers a secure way to use virtual-hosting and SSL in some situations:
 * for example you want to connect to "bar.com" but you know in advance
 * that the SSL Certificate on that server only contains "CN=foo.com".  If
 * you setAllowedNames( new String[] { "foo.com" } ) on your SSLClient in
 * advance, you can connect securely, while still using "bar.com" as the
 * host.
 *
 * Here's a code example using "cucbc.com" to connect, but anticipating
 * "www.cucbc.com" in the server's certificate:
 * <pre>
 * SSLClient client = new SSLClient();
 * client.setAllowedNames( new String[] { "www.cucbc.com" } );
 * Socket s = client.createSocket( "cucbc.com", 443 );
 * </pre>
 *
 * This technique is also useful if you don't want to use DNS, and want to
 * connect using the IP address.
 *
 * @param allowedNames array of alternate "allowed names" to try against a
 * server's x509 CN field if the host/ip we used didn't match.  Set to null
 * to force strict matching against host/ip passed into createSocket().
 * Null is the default value.  Must be set in advance, before createSocket() is
 * called.
 */
public void setAllowedNames( String[] allowedNames )
{
	this.allowedNames = allowedNames;
}


Any comments?

The way I've coded it, things get kind of exciting with wildcards.
Here's a code example using "credential.com" to connect, but
anticipating "*.credential.com" in the server's certificate:

SSLClient client = new SSLClient();
client.setAllowedNames( new String[] { "ooga_booga.credential.com" } );
Socket s = client.createSocket( "credential.com", 443 );

But I think that actually makes sense in a wildcard kind of way.

(I plan to sell DVD's through late night infomercials called
"Certificates gone Wildcard").


-- 
yours,

Julius Davies
416-652-0183
http://juliusdavies.ca/

---------------------------------------------------------------------
To unsubscribe, e-mail: httpcomponents-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: httpcomponents-dev-help@jakarta.apache.org

Re: [https/ssl] - CN verification: setAllowedNames() idea

[Julius Davies <ju...@gmail.com>]

Hi, Roland,

Thanks for looking at this, and thanks for your suggestion.  I'm going
to do that.  Thanks!  I got distracted by:

SSLSocket.setEnabledCipherSuites(String[] suites)
SSLSocket.setEnabledProtocols(String[] protocols)

:-)


yours,

Julius



On 2/18/07, Roland Weber <ht...@dubioso.net> wrote:
> Hi Julius,
>
> > public void setAllowedNames( String[] allowedNames )
> > {
> >     this.allowedNames = allowedNames;
> > }
>
> I like the idea. But you might want to keep the names in
> an internal collection (ArrayList/LinkedList) and offer
>   addAllowedName(String)
>   addAllowedNames(String[])
>   clearAllowedNames()
> instead of passing in an array. That makes sure that the
> internal data structure is not modified uncontrolled.
>
> cheers,
>   Roland
>

-- 
yours,

Julius Davies
416-652-0183
http://juliusdavies.ca/

---------------------------------------------------------------------
To unsubscribe, e-mail: httpcomponents-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: httpcomponents-dev-help@jakarta.apache.org

Re: [https/ssl] - CN verification: setAllowedNames() idea

[Roland Weber <ht...@dubioso.net>]

Hi Julius,

> public void setAllowedNames( String[] allowedNames )
> {
>     this.allowedNames = allowedNames;
> }

I like the idea. But you might want to keep the names in
an internal collection (ArrayList/LinkedList) and offer
  addAllowedName(String)
  addAllowedNames(String[])
  clearAllowedNames()
instead of passing in an array. That makes sure that the
internal data structure is not modified uncontrolled.

cheers,
  Roland


---------------------------------------------------------------------
To unsubscribe, e-mail: httpcomponents-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: httpcomponents-dev-help@jakarta.apache.org