spring-cloud / spring-cloud/spring-cloud-gateway

SpringCloudGateway MVC route two certificates problem

Open
#3,986 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

feedback-provided
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Hello.

Not sure if Spring-Cloud-Gateway MVC (SCG) fails or Spring's HttpClient, but after upgrading to SCG 4.3.0 and Spring 3.5.6 I faced this issue.
We have two Web applications (let's name them MyApp1 and MyApp2) configured on the same ApacheHttpServer: there are two virtual hosts configurations on the same IP and 443 port, but with their own certificates. I access one of these applications (MyApp2) via SCG route; certificate stored in truststore, that comes with SCG application. Before version 4.3.0 everything worked fine, but after upgrade of SCG application couldn't connect to MyApp2, because during handshake it receives certificate of application MyApp1 and refuses connection.
Strange thing is if in AppacheHttpServer I place configuration of MyApp2 before configuration of MyApp1, then it works and SCG application gets correct certificate.
I'm not sure, but it looks like in newer version certificate is received by IP:port and it takes a first in a row certificate. In earlier version of SCG (e.g. 4.1.4) it received correct certificate (maybe by domain name).
We solved this issue by re-configuring ApacheServer for MyApp2 on different port. After that SCG receives correct certificate, and handshake ends successfully.

I can't provide a sample, because Apache server and two other web applications are required with SSL configured, but I hope I describe the issue clearly. If not please ask.

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the upgrade regression with Spring Cloud Gateway 4.3.0, Spring 3.5.6, and two Apache HTTPS virtual hosts sharing an IP and port; compare the behavior with Gateway 4.1.4. Inspect the outbound HTTPS client and hostname-based certificate selection. Done means a route to MyApp2 completes its handshake with MyApp2's certificate without requiring a separate port.

Written by the indexing model from the issue text.

Assessment

Tech stack
apache, java, spring, spring-boot
Domain
api, backend, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.