[JIRA] Created: (JOST-186) HTTPS scheme in FileBackedHTTPMetadataProvider does not perform hostname verification

[Takeshi Nishimura (JIRA)]

HTTPS scheme in FileBackedHTTPMetadataProvider does not perform hostname verification
-------------------------------------------------------------------------------------

                 Key: JOST-186
                 URL: https://issues.shibboleth.net/jira/browse/JOST-186
             Project: OpenSAML 2 - Java
          Issue Type: Improvement
          Components: SAML 2
    Affects Versions: 2.5.3
         Environment: CentOS 5.8
Shibboleth IdP 2.3.6
Tomcat 6.0.35
OpenJDK 1.6.0 (java-1.6.0-openjdk-1.6.0.0-1.25.1.10.6.el5_8)
            Reporter: Takeshi Nishimura
            Assignee: Chad La Joie
            Priority: Minor


When using HTTPS scheme in FileBackedHTTPMetadataProvider, hostname is not verified.

Actual results:
https://metadata.gakunin.nii.ac.jp/gakunin-test-metadata.xml - OK
https://metadata2.gakunin.nii.ac.jp/gakunin-test-metadata.xml - OK
https://157.1.72.50/gakunin-test-metadata.xml - OK

Expected results:
https://metadata.gakunin.nii.ac.jp/gakunin-test-metadata.xml - OK
https://metadata2.gakunin.nii.ac.jp/gakunin-test-metadata.xml - NG
https://157.1.72.50/gakunin-test-metadata.xml - NG
(The certificate presented by this host contains only one hostname "metadata.gakunin.nii.ac.jp".)

cf.
Private certificates and expired certificates are checked correctly.

Error log for a private certificate:
{noformat}
12:06:35.705 - DEBUG [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:249] - Attempting to fetch metadata document from 'https://172.16.100.98/gakunin-test-metadata.xml'
12:06:37.181 - ERROR [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error retrieving metadata from https://172.16.100.98/gakunin-test-metadata.xml
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
{noformat}
Error log for an expired certificate:
{noformat}
12:04:58.641 - DEBUG [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:249] - Attempting to fetch metadata document from 'https://172.16.100.99/gakunin-test-metadata.xml'
12:04:58.939 - ERROR [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error retrieving metadata from https://172.16.100.99/gakunin-test-metadata.xml
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed
{noformat}


--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira