spring-projects / spring-projects/spring-security

Certificate related - failed hostname verification check

Open
#7,509 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

status: waiting-for-triage
Dominant language
Java
Stars
9.6k
Forks
6.3k
Avg merge
2d 11h
Merged PRs (30d)
52

Description

Spring Security 5.2 is logging new warning messages related to hostname verification checks. I haven't applied any changes to the application code upon applying the patch from 5.1.6 -> 5.2.0.
Is the framework now expecting a new trusted certificate to be added to the JDK or something?

<Oct 3, 2019 12:54:40,261 PM EDT> <Loading the identity certificate and private key stored under the alias DemoIdentity from the jks keystore file D:\BEA1221\user_projects\domains\MyDomain\security\DemoIdentity.jks.>
<Oct 3, 2019 12:54:40,268 PM EDT> <Loading trusted certificates from the jks keystore file D:\BEA1221\wlserver\server\lib\DemoTrust.jks.>
<Oct 3, 2019 12:54:40,274 PM EDT> <Loading trusted certificates from the jks keystore file D:\BEA1221\oracle_common\jdk\jre\lib\security\cacerts.>
<Oct 3, 2019 12:54:40,641 PM EDT> <Certificate chain received from www.springframework.org - 104.26.613.9 failed hostname verification check. Certificate contained ssl385749.cloudflaressl.com but check expected www.springframework.org>
<Oct 3, 2019 12:54:43,230 PM EDT> <Certificate chain received from www.springframework.org - 104.26.613.9 failed hostname verification check. Certificate contained ssl385749.cloudflaressl.com but check expected www.springframework.org>

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

The report concerns the Spring Security 5.1.6-to-5.2.0 upgrade and hostname verification for www.springframework.org, with certificates loaded from DemoIdentity.jks, DemoTrust.jks, and the JDK cacerts file. Start by reproducing the warning in the reported WebLogic environment and trace the hostname-verification path; done requires identifying whether the framework behavior or certificate setup is responsible and adding a focused regression test if a framework defect is confirmed.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring
Domain
security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.