Mailing-List: contact issues-help@geode.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@geode.apache.org
Date: Thu, 28 Sep 2017 14:27:00 +0000 (UTC)
From: "ASF subversion and git services (JIRA)" <jira@apache.org>
To: issues@geode.apache.org
Message-ID: <JIRA.13103025.1505759462000.226148.1506608820873@Atlassian.JIRA>
In-Reply-To: <JIRA.13103025.1505759462000@Atlassian.JIRA>
References: <JIRA.13103025.1505759462000@Atlassian.JIRA> <JIRA.13103025.1505759462422@jira-lw-us.apache.org>
Subject: [jira] [Commented] (GEODE-3640) Connect with --skip-ssl-validation
 should not require a Keystore or Truststore
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
archived-at: Thu, 28 Sep 2017 14:27:05 -0000


    [ https://issues.apache.org/jira/browse/GEODE-3640?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16184243#comment-16184243 ] 

ASF subversion and git services commented on GEODE-3640:
--------------------------------------------------------

Commit 640f89d776c6388a94d818c9e635e262fa75db6d in geode's branch refs/heads/develop from [~jens.deppe]
[ https://gitbox.apache.org/repos/asf?p=geode.git;h=640f89d ]

GEODE-3640 Push setting default hostname verifier down to configureHttpsURLConnection()


> Connect with --skip-ssl-validation should not require a Keystore or Truststore
> ------------------------------------------------------------------------------
>
>                 Key: GEODE-3640
>                 URL: https://issues.apache.org/jira/browse/GEODE-3640
>             Project: Geode
>          Issue Type: Bug
>          Components: docs, gfsh, security
>    Affects Versions: 1.2.0
>            Reporter: Jared Stewart
>            Assignee: Jared Stewart
>             Fix For: 1.3.0
>
>
> We are still requiring a Keystore and Truststore to be specified if a user connects via gfsh with --skip-ssl-validation.  We ought to be able to fall back to the default JVM truststore in this case since we shouldn't be validating the server's certificate, and thus shouldn't need a custom Truststore.  And since the gfsh client should not get its identity verified by the server, it should not require a custom Keystore.  
> This is what happens currently if you omit those options: 
> {noformat}
> gfsh>connect --use-http --url=https://locator-address/gemfire/v1 --user=username --password=******** --skip-ssl-validation
> I/O error on GET request for "https://locator-address/gemfire/v1/index": sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target; nested exception is javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
> {noformat}


--
This message was sent by Atlassian JIRA
(v6.4.14#64029)