[JIRA] (OSJ-379) "trustAnchors parameter must be non-empty" failure in httpClient

[Paul B. Henson (Jira)]

Paul B. Henson ( https://shibboleth.atlassian.net/secure/ViewProfile.jspa?accountId=5b58f937ffd0a32d7917a0df ) *commented* on OSJ-379 ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiY2VkYjA2YWEwY2NkNDRhNjkyNTU5OGIzYmJhOTEwMTEiLCJwIjoiaiJ9 )

Re: "trustAnchors parameter must be non-empty" failure in httpClient ( https://shibboleth.atlassian.net/browse/OSJ-379?atlOrigin=eyJpIjoiY2VkYjA2YWEwY2NkNDRhNjkyNTU5OGIzYmJhOTEwMTEiLCJwIjoiaiJ9 )

I recently tested a scenario where the name in the URL in the metadata config did not match the cert name, and that failed:

2023-05-15 15:42:48,388 - / - ERROR [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:238] - Meta
data Resolver FileBackedHTTPMetadataResolver CSUconnect: Error retrieving metadata from https://137.145.17.65/
metadata/CSUconnect-test-metadata.xml: TLS hostname verification failed for hostname: 137.145.17.65

I just tested against one with an unknown CA, and that fails too:

2023-05-17 11:41:48,583 - / - ERROR [org.opensaml.saml.metadata.resolver.impl.HTTPMetadataResolver:238] - Meta
data Resolver FileBackedHTTPMetadataResolver CSUconnect: Error retrieving metadata from https://self-signed.ba
dssl.com/metadata/CSUconnect-test-metadata.xml: PKIX path building failed: sun.security.provider.certpath.SunC
ertPathBuilderException: unable to find valid certification path to requested target

Unfortunately I can’t reproduce the trust anchor error to check whether anything fixes it , it just shows up randomly and fortunately infrequently. I wonder if at some point something that explicitly removes the trust anchor to disable the java store uses the same httpclient as the metadata resolver and breaks it?

( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiY2VkYjA2YWEwY2NkNDRhNjkyNTU5OGIzYmJhOTEwMTEiLCJwIjoiaiJ9 ) Add Comment ( https://shibboleth.atlassian.net/browse/OSJ-379#add-comment?atlOrigin=eyJpIjoiY2VkYjA2YWEwY2NkNDRhNjkyNTU5OGIzYmJhOTEwMTEiLCJwIjoiaiJ9 )

Get Jira notifications on your phone! Download the Jira Cloud app for Android ( https://play.google.com/store/apps/details?id=com.atlassian.android.jira.core&referrer=utm_source%3DNotificationLink%26utm_medium%3DEmail ) or iOS ( https://itunes.apple.com/app/apple-store/id1006972087?pt=696495&ct=EmailNotificationLink&mt=8 ) This message was sent by Atlassian Jira (v1001.0.0-SNAPSHOT#100225- sha1:11e4e77 )
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/b2874604/attachment-0001.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-comment-icon-1d8a306f-97c4-4e30-96a0-1cd2ce1cf3c4
Type: image/png
Size: 1084 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/b2874604/attachment-0004.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-sad-e8252ea7-96d0-4ebe-a02c-7f5002f9b9c4
Type: image/png
Size: 778 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/b2874604/attachment-0005.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-avatar-43f64a90-084e-44bf-acd7-f77ff783b000
Type: image/png
Size: 345 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/b2874604/attachment-0006.png>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: jira-generated-image-static-footer-desktop-logo-59b7b6dc-95e8-4469-9447-0463ec1413d8
Type: image/png
Size: 10805 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/commits/attachments/20230517/b2874604/attachment-0007.png>