Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-8328723 IP Address error when client enables HTTPS endpoint check on server socket
  3. JDK-8335686

Release Note: Fix Exception message when HTTPS Endpoint Identification Algorithm is set on SSL Server

XMLWordPrintable

    • Icon: Sub-task Sub-task
    • Resolution: Withdrawn
    • Icon: P4 P4
    • 24
    • None
    • security-libs

      When endpoint identification algorithm is set to "HTTPS" on SSL Server using the method `setEndpointIdentificationAlgorithm()` and SubjectAltName extension of client certificate does not match it's IP address, then one of the below exceptions can be thrown

      1. java.security.cert.CertificateException: No subject alternative names present
      2. java.security.cert.CertificateException: No subject alternative names matching IP address <clientIP> found

      Typically, the server has no external knowledge of what the client's identity ought to be and hence identity checks are not possible (other than that the client has a certificate chain rooted in an appropriate CA).

      The exception messages has been changed to `java.security.cert.CertificateException: Endpoint Identification Algorithm HTTPS is not supported on the server side` indicating "HTTPS" endpoint identification algorithm must be disabled and is not valid on the server side.

            pkumaraswamy Prajwal Kumaraswamy
            pkumaraswamy Prajwal Kumaraswamy
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated:
              Resolved: