Investigate TLSv1.3 with Conscrypt
- Vorherrschende Sprache
- Java
- Sterne
- 12.1k
- Forks
- 4k
- Ø Merge
- 2 T. 17 Std.
- Gemergte PRs (30 T.)
- 37
Beschreibung
For some reason Conscrypt is incompatible with TLSv1.3 in ways that I wouldn't expect. It is known incompatible with the default TrustManager on older JDKs because those don't support TLSv1.3. But I explicitly constructed a TrustManagerFactory with the Conscrypt provider and passed it to `sslContextBuilder.trustManager(TrustManagerFactory)` and it still failed (the stack trace makes it seem like it didn't use the TrustManager I provided):
JDK 8u232 (TlsTest)
```
java.security.cert.CertificateException: java.lang.IllegalArgumentException: TLSv1.3
at org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1654)
at org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
at org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:567)
at org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1097)
at org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1081)
... 26 more
Caused by:
java.lang.IllegalArgumentException: TLSv1.3
at sun.security.ssl.ProtocolVersion.valueOf(ProtocolVersion.java:187)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:266)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
at org.conscrypt.Platform.checkServerTrusted(Platform.java:330)
at org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1646)
... 30 more
```
But there's incompatibilities with JDK 8u275, which supports TLSv1.3, which is super-unfortunate:
```
java.security.cert.CertificateException: Unknown authType: GENERIC
at sun.security.validator.EndEntityChecker.checkTLSServer(EndEntityChecker.java:289)
at sun.security.validator.EndEntityChecker.check(EndEntityChecker.java:144)
at sun.security.validator.Validator.validate(Validator.java:284)
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:315)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:278)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:141)
at org.conscrypt.Platform.checkServerTrusted(Platform.java:330)
at org.conscrypt.ConscryptEngine.verifyCertificateChain(ConscryptEngine.java:1646)
at org.conscrypt.NativeCrypto.ENGINE_SSL_read_direct(Native Method)
at org.conscrypt.NativeSsl.readDirectByteBuffer(NativeSsl.java:567)
at org.conscrypt.ConscryptEngine.readPlaintextDataDirect(ConscryptEngine.java:1097)
at org.conscrypt.ConscryptEngine.readPlaintextData(ConscryptEngine.java:1081)
```
Beitragsleitfaden
Rechercherichtung
Start with TlsTest and the sslContextBuilder.trustManager(TrustManagerFactory) call, then trace the stack frames through org.conscrypt.Platform.checkServerTrusted and ConscryptEngine.verifyCertificateChain. Reproduce the failures on the cited JDK 8u232 and 8u275 environments; done means identifying the TrustManager and TLSv1.3 compatibility cause or documenting a concrete fix.
Vom Indexierungsmodell aus dem Issue-Text verfasst.
Bewertung
- Tech-Stack
- java
- Bereich
- networking, security
- Issue-Typ
- Bug
- Schwierigkeit
- 4/5
- Geschätzter Aufwand
- 3-5 Tage
- Aktivitätsstatus
- Veraltet
- Klarheit
- Muss geklärt werden
- Anfängerfreundlichkeit
- 25/100