elastic / elastic/apm-agent-java
Weblogic TLS default certificate validation does not support wildcards
- Dominant language
- Java
- Stars
- 594
- Forks
- 338
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 25
Description
Discovered with `1.28.4` agent + Weblogic 12c `12.2.1.3.0`, very likely to impact other versions as well.
## Description & Symptoms
By default, Weblogic application server uses a very strict TLS validation that does not support wildcard certificates.
In Weblogic console output:
```
```
Agent sees that like a communication issue and is not able to send any data.
```
2022-01-20 17:31:17,971 [elastic-apm-server-reporter] ERROR co.elastic.apm.agent.report.IntakeV2ReportingEventHandler - Error trying to connect to APM Server at https://xxxxxxxxx.apm.eu-central-1.aws.cloud.es.io:443/intake/v2/events. Some details about SSL configurations corresponding the current connection are logged at INFO level.
```
Disabling APM server certificate validation in agent configuration DOES NOT allow to bypass this restriction.
## Work-around
For now the only work-around requires to modify Weblogic configuration through administration console:
In server SSL settings > Advanced , you have to change the default value for `Hostname Verification` from `BEA Hostname Verifier` to `None`.

## Important note
From a security perspective, it might not be desirable to make the agent able to bypass this restriction automatically.
However we could definitely make the out-of-the-box experience better when this happens:
- provide proper documentation of this work-around and make the agent provide a link to help the user when this happens
- maybe provide a single option (disabled by default) to enable the agent to bypass this, which prevents having to modify Weblogic configuration.
Contributor guide
Assessment
This issue has not been assessed yet.