What happened at the end?
I'm having the same issue and find insane that disabling all the security
(just to identify where is the issue) is still not working.
On Wednesday, 18 May 2016 22:13:03 UTC+1, Eric Swenson wrote:
>
> Apart from my prior point — that it is not practical for my test
> environment to configure all the trust anchors (self signed cert signer), I
> decided to try it anyhow for a single self-signed cert. I still am having
> issues: here is the code:
>
> val trustStoreConfig = TrustStoreConfig(None,
> Some("/Users/eswenson/self-signed-cert.jks"))
> val trustManagerConfig =
> TrustManagerConfig().withTrustStoreConfigs(List(trustStoreConfig))
>
> val looseConfig = SSLLooseConfig().withAcceptAnyCertificate(true).
> withDisableHostnameVerification(true).
> withAllowLegacyHelloMessages(Some(true)).
> withAllowUnsafeRenegotiation(Some(true)).
> withAllowWeakCiphers(true).
> withAllowWeakProtocols(true).
> withDisableSNI(true)
>
> val sslConfig = AkkaSSLConfig().mapSettings(s =>
> s.withLoose(looseConfig).withTrustManagerConfig(trustManagerConfig)
> )
>
> val connectionContext = Http().createClientHttpsContext(sslConfig)
>
> lazy val connectionFlow: Flow[HttpRequest, HttpResponse, Any] =
> Http().outgoingConnectionHttps(host, port, connectionContext)
>
> def httpSRequest(request: HttpRequest): Future[HttpResponse] =
> Source.single(request).via(connectionFlow).runWith(Sink.head)
>
> As you can see, I’m using a trust store with the self-signed cert in it.
> Even with the trust store and enabling all the loose config options (I
> tried it without looseConfig to no avail), I’m still getting errors:
>
> background log: info: [INFO] [05/17/2016 18:49:17.574]
> [ClusterSystem-akka.actor.default-dispatcher-25] [ExperimentInstance(
> akka://ClusterSystem)] fetchExperiment:
> exception=akka.stream.ConnectionException: Hostname verification failed!
> Expected session to be for
> xxx-GfsElb-1RLMB4EAK0HUM-785838730.us-west-2.elb.amazonaws.com
> <http://xxx-gfselb-1rlmb4eak0hum-785838730.us-west-2.elb.amazonaws.com>
> background log: error: akka.stream.ConnectionException: Hostname
> verification failed! Expected session to be for
> xxx-GfsElElb-1RLMB4EAK0HUM-785838730.us-west-2.elb.amazonaws.com
> <http://xxx-gfselelb-1rlmb4eak0hum-785838730.us-west-2.elb.amazonaws.com>
>
> Why is it doing any host name verification? The loose config specifies:
>
> withDisableHostnameVerification(true)
>
> I’m finding it hard to believe it is this hard to do HTTPS with
> self-signed certs. Any suggestions?
>
> — Eric
>
> On May 17, 2016, at 5:11 PM, Eric Swenson <er...@swenson.org <javascript:>>
> wrote:
>
> I don't want or need to configure a specific trust anchor. I want to be
> able to do the equivalent of "curl -k" on a set of local servers, with
> different signing certs. I would have thought the loose
> "acceptAnyCertificate" would have been precisely for this. What does that
> setting do?
>
> If the only way to allow self-signed certs is through setting up a trust
> store, I can do that.
>
>
> -- Eric
>
>
> On May 17, 2016, at 16:30, Konrad Malawski <konrad....@lightbend.com
> <javascript:>> wrote:
>
> Have you attempted to "do the right thing" ™?
> Which is to add the certificate to a trust store, instead of disabling all
> TLS features?
>
> It's actually not that hard and documented here:
> http://typesafehub.github.io/ssl-config/CertificateGeneration.html
>
> Also, you can always drop down to the raw low level Java APIs, as this
> example shows:
>
> https://github.com/akka/akka/blob/master/akka-http-tests/src/main/java/akka/http/javadsl/server/examples/simple/SimpleServerApp.java
> (it's server side, but the same process can be done for client – pretty
> much)
>
> --
> Konrad `ktoso` Malawski
> Akka <http://akka.io/> @ Lightbend <http://lightbend.com/>
>
> On 18 May 2016 at 01:25:32, Eric Swenson (er...@swenson.org <javascript:>)
> wrote:
>
> I have a need (no, not in production) to have an akka-based service
> contact another service using TLS where the remote service is using a
> self-signed cert.
>
> I've used AkkaSSLConfig to configure the "loose" settings:
>
> val looseConfig = SSLLooseConfig().withAcceptAnyCertificate(true).
> withDisableHostnameVerification(true).
> withAllowLegacyHelloMessages(Some(true)).
> withAllowUnsafeRenegotiation(Some(true)).
> withAllowWeakCiphers(true).
> withAllowWeakProtocols(true).
> withDisableSNI(true)
>
>
> and despite trying all of the, still get the following exception when
> trying to access the remote service:
>
> sun.security.validator.ValidatorException: PKIX path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target
>
>
> It was my impression that the loose config:
>
>
> withAcceptAnyCertificate(true)
>
>
> should have prevented the TLS implementation from trying to verify the
> cert.
>
>
> What am I missing? What the the correct way to accept self-signed certs
> using akka-http's Http() client?
>
>
> -- Eric
>
>
>
>
>
> --
> >>>>>>>>>> Read the docs: http://akka.io/docs/
> >>>>>>>>>> Check the FAQ:
> http://doc.akka.io/docs/akka/current/additional/faq.html
> >>>>>>>>>> Search the archives: https://groups.google.com/group/akka-user
> ---
> You received this message because you are subscribed to the Google Groups
> "Akka User List" group.
> To unsubscribe from this group and stop receiving emails from it, send an
> email to akka-user+...@googlegroups.com <javascript:>.
> To post to this group, send email to akka...@googlegroups.com
> <javascript:>.
> Visit this group at https://groups.google.com/group/akka-user.
> For more options, visit https://groups.google.com/d/optout.
>
>
>
--
>>>>>>>>>> Read the docs: http://akka.io/docs/
>>>>>>>>>> Check the FAQ:
>>>>>>>>>> http://doc.akka.io/docs/akka/current/additional/faq.html
>>>>>>>>>> Search the archives: https://groups.google.com/group/akka-user
---
You received this message because you are subscribed to the Google Groups "Akka
User List" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to akka-user+unsubscr...@googlegroups.com.
To post to this group, send email to akka-user@googlegroups.com.
Visit this group at https://groups.google.com/group/akka-user.
For more options, visit https://groups.google.com/d/optout.
