Uploaded image for project: 'Infinispan'
  1. Infinispan
  2. ISPN-4313

If Hotrod Server encryption's require-ssl-client-auth is set to true, <truststore .. /> existence must be checked

    XMLWordPrintable

Details

    Description

      Currently the Infinispan Server can be configured with SSL encryption such that it requires the client to authenticate itself to the server for the purposes of encryption. This can be done by setting the attribute require-ssl-client-auth="true" as shown below.

          <hotrod-connector socket-binding="hotrod" cache-container="security">
              ....
              <encryption security-realm="ApplicationRealm" require-ssl-client-auth="true"/>
              ....
          </hotrod>

      But when that attribute is set to "true" a check should be enforced to check the existence of the the <truststore .. /> element exists in secruity-realm's <authentication>.

      If the check on the configuration fails, the server should throw and error on bootup rather than fail when client connections start to come in.

      Currently when the require-ssl-client-auth="true" and there is no <truststore../> configured, client connections fail and the exception below is thrown in the server's logs:

      javax.net.ssl.SSLHandshakeException: null cert chain

      Attachments

        Activity

          People

            ttarrant@redhat.com Tristan Tarrant
            vchintal@redhat.com Vijay Chintalapati (Inactive)
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: