I don't want or need to configure a specific trust anchor. I want to be able to do the equivalent of "curl -k" on a set of local servers, with different signing certs. I would have thought the loose "acceptAnyCertificate" would have been precisely for this. What does that setting do?
If the only way to allow self-signed certs is through setting up a trust store, I can do that. -- Eric > On May 17, 2016, at 16:30, Konrad Malawski <konrad.malaw...@lightbend.com> > wrote: > > Have you attempted to "do the right thing" ™? > Which is to add the certificate to a trust store, instead of disabling all > TLS features? > > It's actually not that hard and documented here: > http://typesafehub.github.io/ssl-config/CertificateGeneration.html > > Also, you can always drop down to the raw low level Java APIs, as this > example shows: > https://github.com/akka/akka/blob/master/akka-http-tests/src/main/java/akka/http/javadsl/server/examples/simple/SimpleServerApp.java > (it's server side, but the same process can be done for client – pretty much) > > -- > Konrad `ktoso` Malawski > Akka @ Lightbend > >> On 18 May 2016 at 01:25:32, Eric Swenson (e...@swenson.org) wrote: >> >> I have a need (no, not in production) to have an akka-based service contact >> another service using TLS where the remote service is using a self-signed >> cert. >> >> I've used AkkaSSLConfig to configure the "loose" settings: >> >> val looseConfig = SSLLooseConfig().withAcceptAnyCertificate(true). >> withDisableHostnameVerification(true). >> withAllowLegacyHelloMessages(Some(true)). >> withAllowUnsafeRenegotiation(Some(true)). >> withAllowWeakCiphers(true). >> withAllowWeakProtocols(true). >> withDisableSNI(true) >> >> and despite trying all of the, still get the following exception when trying >> to access the remote service: >> >> sun.security.validator.ValidatorException: PKIX path building failed: >> sun.security.provider.certpath.SunCertPathBuilderException: unable to find >> valid certification path to requested target >> >> >> >> It was my impression that the loose config: >> >> >> >> withAcceptAnyCertificate(true) >> >> >> >> should have prevented the TLS implementation from trying to verify the cert. >> >> >> >> What am I missing? What the the correct way to accept self-signed certs >> using akka-http's Http() client? >> >> >> >> -- Eric >> >> >> >> >> >> >> -- >> >>>>>>>>>> Read the docs: http://akka.io/docs/ >> >>>>>>>>>> Check the FAQ: >> >>>>>>>>>> http://doc.akka.io/docs/akka/current/additional/faq.html >> >>>>>>>>>> Search the archives: https://groups.google.com/group/akka-user >> --- >> You received this message because you are subscribed to the Google Groups >> "Akka User List" group. >> To unsubscribe from this group and stop receiving emails from it, send an >> email to akka-user+unsubscr...@googlegroups.com. >> To post to this group, send email to akka-user@googlegroups.com. >> Visit this group at https://groups.google.com/group/akka-user. >> For more options, visit https://groups.google.com/d/optout. -- >>>>>>>>>> Read the docs: http://akka.io/docs/ >>>>>>>>>> Check the FAQ: >>>>>>>>>> http://doc.akka.io/docs/akka/current/additional/faq.html >>>>>>>>>> Search the archives: https://groups.google.com/group/akka-user --- You received this message because you are subscribed to the Google Groups "Akka User List" group. To unsubscribe from this group and stop receiving emails from it, send an email to akka-user+unsubscr...@googlegroups.com. To post to this group, send email to akka-user@googlegroups.com. Visit this group at https://groups.google.com/group/akka-user. For more options, visit https://groups.google.com/d/optout.
