<html>
<head>
<meta content="text/html; charset=windows-1252"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<p><br>
</p>
<br>
<div class="moz-cite-prefix">On 5/23/16 10:34 AM, Randall,Matt
wrote:<br>
</div>
<blockquote
cite="mid:33bee9918a634e5d8d256d2e9d1aea17@CERNMSGKC2EX02D.cerner.net"
type="cite">
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
<meta name="Generator" content="Microsoft Word 14 (filtered
medium)">
<style><!--
/* Font Definitions */
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
p.emailquote, li.emailquote, div.emailquote
{mso-style-name:emailquote;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:1.0pt;
border:none;
padding:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";
color:black;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
<div class="WordSection1">
<p class="MsoNormal"><br>
<span style="color:#1F497D">>> </span>I don't know
whether the behavior you describe is a fundamental API
contract, or just a detail of the particular Java impl you're
using. Just for the record, what is the Java platform and
version you are using here?<br>
<br>
<span style="color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">It’s
the fundamental API contract. Using Sun and IBM JDKs for
Java 8; also verified the OpenJDK implementation is in-line
with my understanding of this function call [1].</span></p>
</div>
</blockquote>
<br>
You may be correct. The Javadocs are are a little unclear though,
at least to me. 2, and perhaps all 3, of those JDKs are essentially
based off the same codebase, fwiw. I think IBM licensed
Sun/Oracle's, at least at one point, not sure about currently.<br>
<br>
<br>
<blockquote
cite="mid:33bee9918a634e5d8d256d2e9d1aea17@CERNMSGKC2EX02D.cerner.net"
type="cite">
<div class="WordSection1">
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p></o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D"><o:p> </o:p></span></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">>>
</span>v2 is EOL at end of July and there will be no more
releases aside from important (through May 31) and critical
(through July 31) security vulnerability bug fixes.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span
style="font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D">I
hadn’t inspected v3’s code base to know whether this issue
would carry-forward or not.</span><br>
</p>
</div>
</blockquote>
<br>
No, it doesn't carry forward to v3. OpenSAML/Shibboleth v3 use
HttpClient v4, which has a completely different set of components
for TLS, with a different API. We do use a custom TLS socket
factory there as well, but the impl is very different and there is
no call to SSLSession#isValid() anywhere.<br>
<br>
The v2 code used with HC v3 was based on their original socket
factory impl, It was only changed because of the previously issues
around hostname validation. IIRC, the HC v3 SSL/TLS stuff didn't
even do hostname validation, so we had to introduce our own code and
deal with all that low-level mess.<br>
</body>
</html>