v3 verifyCertificates NONSTRICT/DISABLED not working as expected in containers
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 92
- Forks
- 81
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 46
Description
Describe the bug
While testing Zowe v3 in a containerized environment where:
- certificates do not contain correct SAN domains
- verifyCertificates is set to either
NONSTRICTorDISABLED
there are errors in APIML pods related to certificate hostname verification. This is taken from an api catalog pod:
2024-10-15 15:05:02.373 <ZWEAGW1:https-jsse-nio-0.0.0.0-7554-exec-1:4302> zowe ERROR ((javax.net.ssl)) Fatal (CERTIFICATE_UNKNOWN): Received fatal alert: certificate_unknown
2024-10-15 15:05:03.918 <ZWEAGW1:reactor-http-epoll-2:4302> zowe ERROR ((javax.net.ssl)) Fatal (CERTIFICATE_UNKNOWN): No subject alternative DNS name matching ***redacted***.pod.cluster.local found.
Steps to Reproduce
- Deploy a containerized environment with verifyCertificates: DISABLED
- View pod logs
Expected behavior
The pods should ignore the missing SAN when verifyCertificates is DISABLED or NONSTRICT
Details
- Version and build number: Zowe v3.0.0
- Test environment: IBM Openshift environment
Similar to #1805 . Expect that if the correct SANs are added to the certificates, the services will start up.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue in the containerized OpenShift environment with verifyCertificates set to DISABLED and NONSTRICT, then compare the behavior with the related issue #1805. Done means the services no longer fail hostname verification because of missing SANs in either mode, while the reported certificate errors are absent from the pod logs.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100