elastic / elastic/apm-agent-java

Weblogic TLS default certificate validation does not support wildcards

Open
#2,410 0 comments 0 reactions 0 assignees View on GitHub
agent-java bug size:small
Dominant language
Java
Stars
594
Forks
338
Avg merge
1d 13h
Merged PRs (30d)
25

Description

Discovered with `1.28.4` agent + Weblogic 12c `12.2.1.3.0`, very likely to impact other versions as well.

## Description & Symptoms

By default, Weblogic application server uses a very strict TLS validation that does not support wildcard certificates.

In Weblogic console output:
```

```

Agent sees that like a communication issue and is not able to send any data.
```
2022-01-20 17:31:17,971 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Error trying to connect to APM Server at https://xxxxxxxxx.apm.eu-central-1.aws.cloud.es.io:443/intake/v2/events. Some details about SSL configurations corresponding the current connection are logged at INFO level.
```

Disabling APM server certificate validation in agent configuration DOES NOT allow to bypass this restriction.

## Work-around

For now the only work-around requires to modify Weblogic configuration through administration console:

In server SSL settings > Advanced , you have to change the default value for `Hostname Verification` from `BEA Hostname Verifier` to `None`.

![Screenshot from 2022-01-20 17-46-23](https://user-images.githubusercontent.com/763082/150383971-e04940ed-86a4-4d9e-828f-cb1447c04c9f.png)

## Important note

From a security perspective, it might not be desirable to make the agent able to bypass this restriction automatically.

However we could definitely make the out-of-the-box experience better when this happens:
- provide proper documentation of this work-around and make the agent provide a link to help the user when this happens
- maybe provide a single option (disabled by default) to enable the agent to bypass this, which prevents having to modify Weblogic configuration.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.