spring-cloud / spring-cloud/spring-cloud-gateway
SpringCloudGateway MVC route two certificates problem
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Hello.
Not sure if Spring-Cloud-Gateway MVC (SCG) fails or Spring's HttpClient, but after upgrading to SCG 4.3.0 and Spring 3.5.6 I faced this issue.
We have two Web applications (let's name them MyApp1 and MyApp2) configured on the same ApacheHttpServer: there are two virtual hosts configurations on the same IP and 443 port, but with their own certificates. I access one of these applications (MyApp2) via SCG route; certificate stored in truststore, that comes with SCG application. Before version 4.3.0 everything worked fine, but after upgrade of SCG application couldn't connect to MyApp2, because during handshake it receives certificate of application MyApp1 and refuses connection.
Strange thing is if in AppacheHttpServer I place configuration of MyApp2 before configuration of MyApp1, then it works and SCG application gets correct certificate.
I'm not sure, but it looks like in newer version certificate is received by IP:port and it takes a first in a row certificate. In earlier version of SCG (e.g. 4.1.4) it received correct certificate (maybe by domain name).
We solved this issue by re-configuring ApacheServer for MyApp2 on different port. After that SCG receives correct certificate, and handshake ends successfully.
I can't provide a sample, because Apache server and two other web applications are required with SSL configured, but I hope I describe the issue clearly. If not please ask.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the upgrade regression with Spring Cloud Gateway 4.3.0, Spring 3.5.6, and two Apache HTTPS virtual hosts sharing an IP and port; compare the behavior with Gateway 4.1.4. Inspect the outbound HTTPS client and hostname-based certificate selection. Done means a route to MyApp2 completes its handshake with MyApp2's certificate without requiring a separate port.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- apache, java, spring, spring-boot
- Domain
- api, backend, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100