eclipse-ee4j / eclipse-ee4j/jersey
Custom javax.net.ssl.TrustManager is overwritten in org.glassfish.jersey.client.internal.HttpUrlConnector#secureConnection
- Dominant language
- Java
- Stars
- 730
- Forks
- 382
- PR merge metrics
- No merged PRs in 30d
Description
Environment: jersey-client-2.25.1
In development one might wish to use self signed certificates and to ease development one can do something like this:
`// Create a trust manager that does not validate certificate chains
TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
@Override
public X509Certificate[] getAcceptedIssuers() {return null;}
@Override
public void checkServerTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {}
@Override
public void checkClientTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {}
} };
// Install the all-trusting trust manager
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());`
This does not work because in org.glassfish.jersey.client.internal.HttpUrlConnector#secureConnection the check `if (HttpsURLConnection.getDefaultSSLSocketFactory() == suc.getSSLSocketFactory())` is true and the `suc.setSSLSocketFactory(sslSocketFactory.get());` overwrites the custom trust manager.
There are use cases in which the jersey client is wrapped in custom libraries and it is not exposed as a public API. In such cases the "clean" solution cannot be used by the client of the custom library:
`Client client = ClientBuilder.newBuilder().sslContext(ctx).hostnameVerifier(new AllowAllHostsHostNameVerifier()).build()`
Contributor guide
Assessment
This issue has not been assessed yet.