<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<br>
<br>
<div class="moz-cite-prefix">On 9/3/15 4:55 PM, Cantor, Scott wrote:<br>
</div>
<blockquote cite="mid:4EB42F74-0668-4870-8D67-34E925A7CEF1@osu.edu"
type="cite">
<pre wrap="">On 9/3/15, 3:59 PM, "dev on behalf of Brent Putman" <a class="moz-txt-link-rfc2396E" href="mailto:dev-bounces@shibboleth.netonbehalfofputmanb@georgetown.edu"><dev-bounces@shibboleth.net on behalf of putmanb@georgetown.edu></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Also IIRC the big thing I saw between 4.3.x and 4.4.x was that business with the public suffix stuff they introduced. Wanted to really get a handle on that before updating. We might want to figure out how to turn all that off, if possible:
</pre>
</blockquote>
<pre wrap="">
At least on the hostname verifier side, aren't we using our own exclusively now? Or am I still screwed up understanding all this?</pre>
</blockquote>
<blockquote cite="mid:4EB42F74-0668-4870-8D67-34E925A7CEF1@osu.edu"
type="cite">
</blockquote>
<br>
In v3, no we don't use our own generally speaking right now. The
HttpClientBuilder does this:<br>
<br>
<tt> if (getTLSSocketFactory() != null) {</tt><tt><br>
</tt><tt>
builder.setSSLSocketFactory(getTLSSocketFactory());</tt><tt><br>
</tt><tt> } else if (connectionDisregardTLSCertificate) {</tt><tt><br>
</tt><tt>
builder.setSSLSocketFactory(HttpClientSupport.buildNoTrustSSLConnectionSocketFactory());</tt><tt><br>
</tt><tt> } else {</tt><tt><br>
</tt><tt>
builder.setSSLSocketFactory(HttpClientSupport.buildStrictSSLConnectionSocketFactory());</tt><tt><br>
</tt><tt> }</tt><br>
<br>
<br>
The first case there could be any TLS factory + verifier. But for
the other 2 we use HC 4.x classes. For the 3rd default case there
we are using their STRICT one:<br>
<br>
<tt>org.apache.http.conn.ssl.SSLConnectionSocketFactory.STRICT_HOSTNAME_VERIFIER</tt><br>
<br>
<br>
The stuff in HC v4.x doesn't suck (as far as we know....) like the
HC 3.x stuff did. So no reason to roll our own hostname verifiers.
So that's why I really wanted to look at the public suffix stuff.
IIRC by default it tries to download the list automatically and
cache it and other ugly stuff.<br>
<br>
<br>
<br>
<br>
</body>
</html>