-
Bug
-
Resolution: Fixed
-
P3
-
None
-
b08
Issue | Fix Version | Assignee | Priority | Status | Resolution | Resolved In Build |
---|---|---|---|---|---|---|
JDK-8337823 | 23.0.2 | Prajwal Kumaraswamy | P3 | Resolved | Fixed | b01 |
JDK-8337335 | 21.0.6-oracle | Prajwal Kumaraswamy | P3 | Resolved | Fixed | b01 |
JDK-8339816 | 21.0.6 | Andrew Lu | P3 | Resolved | Fixed | b01 |
JDK-8337336 | 17.0.14-oracle | Prajwal Kumaraswamy | P3 | Resolved | Fixed | b01 |
JDK-8339811 | 17.0.14 | Andrew Lu | P3 | Resolved | Fixed | b01 |
JDK-8337338 | 11.0.26-oracle | Prajwal Kumaraswamy | P3 | Resolved | Fixed | b01 |
JDK-8338193 | 8u441 | Prajwal Kumaraswamy | P3 | Resolved | Fixed | b01 |
The endpoint identification algorithm HTTPS is defined on the Java Security Standard Algorithm Names page [1], and points to RFC 2818 [2]. The RFC defines steps to perform server identity checks. For client identity, the RFC states [3]:
Typically, the server has no external knowledge of what the client's
identity ought to be and so checks (other than that the client has a
certificate chain rooted in an appropriate CA) are not possible. If a
server has such knowledge (typically from some source external to
HTTP or TLS) it SHOULD check the identity as described above.
There's no way to specify the external source of knowledge, so we should disable HTTPS identity checks on the server side.
[1] https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#additional-jsse-standard-names
[2] https://datatracker.ietf.org/doc/html/rfc2818
[3] https://datatracker.ietf.org/doc/html/rfc2818#section-3.2
Steps to reproduce:
- create a SSLServerSocket
- activate client authentication on SSLServerSocket (setNeedClientAuth(true))
- set endpoint identification algorithm to HTTPS
- connect to the SSLServerSocket with a certificate
Actual results are one of the following, depending on the certificate used:
- java.security.cert.CertificateException: No subject alternative names present
- java.security.cert.CertificateException: No subject alternative names matching IP address <clientIP> found
- successful connection, if the client certificate contains SubjectAltName extension matching its IP address
Expected result:
- java.security.cert.CertificateException: Identification algorithm HTTPS is not supported on the server side
- backported by
-
JDK-8337335 IP Address error when client enables HTTPS endpoint check on server socket
-
- Resolved
-
-
JDK-8337336 IP Address error when client enables HTTPS endpoint check on server socket
-
- Resolved
-
-
JDK-8337338 IP Address error when client enables HTTPS endpoint check on server socket
-
- Resolved
-
-
JDK-8337823 IP Address error when client enables HTTPS endpoint check on server socket
-
- Resolved
-
-
JDK-8338193 IP Address error when client enables HTTPS endpoint check on server socket
-
- Resolved
-
-
JDK-8339811 IP Address error when client enables HTTPS endpoint check on server socket
-
- Resolved
-
-
JDK-8339816 IP Address error when client enables HTTPS endpoint check on server socket
-
- Resolved
-
- links to
-
Commit(master) openjdk/jdk17u-dev/8cea90b9
-
Commit(master) openjdk/jdk21u-dev/c66ea3d3
-
Commit(master) openjdk/jdk23u/c3d15683
-
Commit(master) openjdk/jdk/1b9270ac
-
Review(master) openjdk/jdk17u-dev/2856
-
Review(master) openjdk/jdk21u-dev/959
-
Review(master) openjdk/jdk23u/48
-
Review(master) openjdk/jdk/20048