zowe / zowe/api-layer

v3 verifyCertificates NONSTRICT/DISABLED not working as expected in containers

Open
#3,870 1 comment 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug Priority: Medium size/M V3
Dominant language
Java
Stars
92
Forks
81
Avg merge
1d 9h
Merged PRs (30d)
46

Description

Describe the bug
While testing Zowe v3 in a containerized environment where:

  • certificates do not contain correct SAN domains
  • verifyCertificates is set to either NONSTRICT or DISABLED
    there are errors in APIML pods related to certificate hostname verification. This is taken from an api catalog pod:
2024-10-15 15:05:02.373 <ZWEAGW1:https-jsse-nio-0.0.0.0-7554-exec-1:4302> zowe ERROR ((javax.net.ssl)) Fatal (CERTIFICATE_UNKNOWN): Received fatal alert: certificate_unknown
2024-10-15 15:05:03.918 <ZWEAGW1:reactor-http-epoll-2:4302> zowe ERROR ((javax.net.ssl)) Fatal (CERTIFICATE_UNKNOWN): No subject alternative DNS name matching ***redacted***.pod.cluster.local found.

Steps to Reproduce

  1. Deploy a containerized environment with verifyCertificates: DISABLED
  2. View pod logs

Expected behavior
The pods should ignore the missing SAN when verifyCertificates is DISABLED or NONSTRICT

Details

  • Version and build number: Zowe v3.0.0
  • Test environment: IBM Openshift environment

Similar to #1805 . Expect that if the correct SANs are added to the certificates, the services will start up.

https://github.com/zowe/api-layer/wiki/Issue-management

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the issue in the containerized OpenShift environment with verifyCertificates set to DISABLED and NONSTRICT, then compare the behavior with the related issue #1805. Done means the services no longer fail hostname verification because of missing SANs in either mode, while the reported certificate errors are absent from the pod logs.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.