Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8328723

IP Address error when client enables HTTPS endpoint check on server socket

XMLWordPrintable

        Client authentication in SSLServerSocket is not working correctly, when configured with endpoint identification algorithm "HTTPS".

        The endpoint identification algorithm HTTPS is defined on the Java Security Standard Algorithm Names page [1], and points to RFC 2818 [2]. The RFC defines steps to perform server identity checks. For client identity, the RFC states [3]:
           Typically, the server has no external knowledge of what the client's
           identity ought to be and so checks (other than that the client has a
           certificate chain rooted in an appropriate CA) are not possible. If a
           server has such knowledge (typically from some source external to
           HTTP or TLS) it SHOULD check the identity as described above.

        There's no way to specify the external source of knowledge, so we should disable HTTPS identity checks on the server side.

        [1] https://docs.oracle.com/en/java/javase/11/docs/specs/security/standard-names.html#additional-jsse-standard-names
        [2] https://datatracker.ietf.org/doc/html/rfc2818
        [3] https://datatracker.ietf.org/doc/html/rfc2818#section-3.2

        Steps to reproduce:
        - create a SSLServerSocket
        - activate client authentication on SSLServerSocket (setNeedClientAuth(true))
        - set endpoint identification algorithm to HTTPS
        - connect to the SSLServerSocket with a certificate

        Actual results are one of the following, depending on the certificate used:
        - java.security.cert.CertificateException: No subject alternative names present
        - java.security.cert.CertificateException: No subject alternative names matching IP address <clientIP> found
        - successful connection, if the client certificate contains SubjectAltName extension matching its IP address

        Expected result:
        - java.security.cert.CertificateException: Identification algorithm HTTPS is not supported on the server side

              pkumaraswamy Prajwal Kumaraswamy
              shadowbug Shadow Bug
              Votes:
              0 Vote for this issue
              Watchers:
              7 Start watching this issue

                Created:
                Updated:
                Resolved: