spring-projects / spring-projects/spring-security
Certificate related - failed hostname verification check
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Spring Security 5.2 is logging new warning messages related to hostname verification checks. I haven't applied any changes to the application code upon applying the patch from 5.1.6 -> 5.2.0.
Is the framework now expecting a new trusted certificate to be added to the JDK or something?
<Oct 3, 2019 12:54:40,261 PM EDT> <Loading the identity certificate and private key stored under the alias DemoIdentity from the jks keystore file D:\BEA1221\user_projects\domains\MyDomain\security\DemoIdentity.jks.>
<Oct 3, 2019 12:54:40,268 PM EDT> <Loading trusted certificates from the jks keystore file D:\BEA1221\wlserver\server\lib\DemoTrust.jks.>
<Oct 3, 2019 12:54:40,274 PM EDT> <Loading trusted certificates from the jks keystore file D:\BEA1221\oracle_common\jdk\jre\lib\security\cacerts.>
<Oct 3, 2019 12:54:40,641 PM EDT> <Certificate chain received from www.springframework.org - 104.26.613.9 failed hostname verification check. Certificate contained ssl385749.cloudflaressl.com but check expected www.springframework.org>
<Oct 3, 2019 12:54:43,230 PM EDT> <Certificate chain received from www.springframework.org - 104.26.613.9 failed hostname verification check. Certificate contained ssl385749.cloudflaressl.com but check expected www.springframework.org>
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The report concerns the Spring Security 5.1.6-to-5.2.0 upgrade and hostname verification for www.springframework.org, with certificates loaded from DemoIdentity.jks, DemoTrust.jks, and the JDK cacerts file. Start by reproducing the warning in the reported WebLogic environment and trace the hostname-verification path; done requires identifying whether the framework behavior or certificate setup is responsible and adding a focused regression test if a framework defect is confirmed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100