Uploaded image for project: 'RESTEasy'
  1. RESTEasy
  2. RESTEASY-2176

Client-side SSL - HostnameVerificationPolicy.STRICT shouldn't accept wildcard certificates

    XMLWordPrintable

Details

    • Bug
    • Resolution: Done
    • Major
    • 3.7.0.Final, 4.1.0.Final
    • 4.0.0.Beta7, 3.6.3.Final
    • None
    • None

    Description

      HostnameVerificationPolicy.STRICT accepts wildcard certificates. Actually, it has exact same effect as HostnameVerificationPolicy.WILDCARD, because of this

      switch (that.getHostnameVerification())
               {
                  case ANY:
                     verifier = new NoopHostnameVerifier();
                     break;
                  case WILDCARD:
                     verifier = new DefaultHostnameVerifier();
                     break;
                  case STRICT:
                     verifier = new DefaultHostnameVerifier();
                     break;
                }
      

      There should be different verifiers used in case of WILDCARD and STRICT.

      See my test. Server is secured with wildcard certificate for hostname "*host" (wildcard for localhost) and HostnameVerificationPolicy.STRICT is used. Exception should be thrown but it isn't.

      Attachments

        Issue Links

          Activity

            People

              rhn-engineering-ema Jim Ma
              tterem@redhat.com Tomas Terem (Inactive)
              Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: