[JIRA] Updated: (JOST-186) HTTPS scheme in FileBackedHTTPMetadataProvider does not perform hostname verification

[Scott Cantor (JIRA)]

     [ https://issues.shibboleth.net/jira/browse/JOST-186?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Scott Cantor updated JOST-186:
------------------------------

    Fix Version/s: 2.5.4
         Assignee: Brent Putman  (was: Chad La Joie)

I suspect this is as designed, but let's confirm and document.

> HTTPS scheme in FileBackedHTTPMetadataProvider does not perform hostname verification
> -------------------------------------------------------------------------------------
>
>                 Key: JOST-186
>                 URL: https://issues.shibboleth.net/jira/browse/JOST-186
>             Project: OpenSAML 2 - Java
>          Issue Type: Improvement
>          Components: SAML 2
>    Affects Versions: 2.5.3
>         Environment: CentOS 5.8
> Shibboleth IdP 2.3.6
> Tomcat 6.0.35
> OpenJDK 1.6.0 (java-1.6.0-openjdk-1.6.0.0-1.25.1.10.6.el5_8)
>            Reporter: Takeshi Nishimura
>            Assignee: Brent Putman
>            Priority: Minor
>             Fix For: 2.5.4
>
>
> When using HTTPS scheme in FileBackedHTTPMetadataProvider, hostname is not verified.
> Actual results:
> https://metadata.gakunin.nii.ac.jp/gakunin-test-metadata.xml - OK
> https://metadata2.gakunin.nii.ac.jp/gakunin-test-metadata.xml - OK
> https://157.1.72.50/gakunin-test-metadata.xml - OK
> Expected results:
> https://metadata.gakunin.nii.ac.jp/gakunin-test-metadata.xml - OK
> https://metadata2.gakunin.nii.ac.jp/gakunin-test-metadata.xml - NG
> https://157.1.72.50/gakunin-test-metadata.xml - NG
> (The certificate presented by this host contains only one hostname "metadata.gakunin.nii.ac.jp".)
> cf.
> Private certificates and expired certificates are checked correctly.
> Error log for a private certificate:
> {noformat}
> 12:06:35.705 - DEBUG [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:249] - Attempting to fetch metadata document from 'https://172.16.100.98/gakunin-test-metadata.xml'
> 12:06:37.181 - ERROR [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error retrieving metadata from https://172.16.100.98/gakunin-test-metadata.xml
> javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
> {noformat}
> Error log for an expired certificate:
> {noformat}
> 12:04:58.641 - DEBUG [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:249] - Attempting to fetch metadata document from 'https://172.16.100.99/gakunin-test-metadata.xml'
> 12:04:58.939 - ERROR [org.opensaml.saml2.metadata.provider.HTTPMetadataProvider:273] - Error retrieving metadata from https://172.16.100.99/gakunin-test-metadata.xml
> javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed
> {noformat}

--
This message is automatically generated by JIRA.
For more information on JIRA, see: http://www.atlassian.com/software/jira