Hi Joan,
To be honest, I haven’t looked at this stuff in ages. We set up our own PKI CA
and switched to using non-self-signed certs. However, before we did this, I
had gotten things working with self-signed certs. Unfortunately, I don’t have
that code in active usage anywhere now. I did find the following commented-out
code in one version of a service. Not sure if it works and even compiles with
the latest Akka. But here it is in its ugly entirety:
/*
// temporary code because we're using self-signed certs
val classLoader: ClassLoader = Thread.currentThread().getContextClassLoader
val jksInputStream = classLoader.getResourceAsStream(“dev.jks")
val jksTempFilePathname = Files.createTempFile("jksTemp", "jks").toString
val jksOutputStream = new FileOutputStream(jksTempFilePathname)
try {
IOUtils.copy(jksInputStream, jksOutputStream)
} finally {
jksInputStream.close
}
val trustStoreConfig = TrustStoreConfig(None, Some(jksTempFilePathname))
val trustManagerConfig =
TrustManagerConfig().withTrustStoreConfigs(List(trustStoreConfig))
val looseConfig = SSLLooseConfig().withDisableHostnameVerification(true)
val sslConfig = AkkaSSLConfig().mapSettings { s =>
s.withLoose(looseConfig).withTrustManagerConfig(trustManagerConfig)
}
*/
> On May 24, 2017, at 04:46, Joan G <j...@goyeau.com> wrote:
>
> What happened at the end?
> I'm having the same issue and find insane that disabling all the security
> (just to identify where is the issue) is still not working.
>
> On Wednesday, 18 May 2016 22:13:03 UTC+1, Eric Swenson wrote:
> Apart from my prior point — that it is not practical for my test environment
> to configure all the trust anchors (self signed cert signer), I decided to
> try it anyhow for a single self-signed cert. I still am having issues: here
> is the code:
>
> val trustStoreConfig = TrustStoreConfig(None,
> Some("/Users/eswenson/self-signed-cert.jks"))
> val trustManagerConfig =
> TrustManagerConfig().withTrustStoreConfigs(List(trustStoreConfig))
>
> val looseConfig = SSLLooseConfig().withAcceptAnyCertificate(true).
> withDisableHostnameVerification(true).
> withAllowLegacyHelloMessages(Some(true)).
> withAllowUnsafeRenegotiation(Some(true)).
> withAllowWeakCiphers(true).
> withAllowWeakProtocols(true).
> withDisableSNI(true)
>
> val sslConfig = AkkaSSLConfig().mapSettings(s =>
> s.withLoose(looseConfig).withTrustManagerConfig(trustManagerConfig)
> )
>
> val connectionContext = Http().createClientHttpsContext(sslConfig)
>
> lazy val connectionFlow: Flow[HttpRequest, HttpResponse, Any] =
> Http().outgoingConnectionHttps(host, port, connectionContext)
>
> def httpSRequest(request: HttpRequest): Future[HttpResponse] =
> Source.single(request).via(connectionFlow).runWith(Sink.head)
>
> As you can see, I’m using a trust store with the self-signed cert in it.
> Even with the trust store and enabling all the loose config options (I tried
> it without looseConfig to no avail), I’m still getting errors:
>
> background log: info: [INFO] [05/17/2016 18:49:17.574]
> [ClusterSystem-akka.actor.default-dispatcher-25]
> [ExperimentInstance(akka://ClusterSystem <>)] fetchExperiment:
> exception=akka.stream.ConnectionException: Hostname verification failed!
> Expected session to be for
> xxx-GfsElb-1RLMB4EAK0HUM-785838730.us-west-2.elb.amazonaws.com
> <http://xxx-gfselb-1rlmb4eak0hum-785838730.us-west-2.elb.amazonaws.com/>
> background log: error: akka.stream.ConnectionException: Hostname verification
> failed! Expected session to be for
> xxx-GfsElElb-1RLMB4EAK0HUM-785838730.us-west-2.elb.amazonaws.com
> <http://xxx-gfselelb-1rlmb4eak0hum-785838730.us-west-2.elb.amazonaws.com/>
>
> Why is it doing any host name verification? The loose config specifies:
>
> withDisableHostnameVerification(true)
>
> I’m finding it hard to believe it is this hard to do HTTPS with self-signed
> certs. Any suggestions?
>
> — Eric
>
>> On May 17, 2016, at 5:11 PM, Eric Swenson <er...@ <>swenson.org
>> <http://swenson.org/>> wrote:
>>
>> I don't want or need to configure a specific trust anchor. I want to be able
>> to do the equivalent of "curl -k" on a set of local servers, with different
>> signing certs. I would have thought the loose "acceptAnyCertificate" would
>> have been precisely for this. What does that setting do?
>>
>> If the only way to allow self-signed certs is through setting up a trust
>> store, I can do that.
>>
>>
>> -- Eric
>>
>>
>> On May 17, 2016, at 16:30, Konrad Malawski <konrad....@ <>lightbend.com
>> <http://lightbend.com/>> wrote:
>>
>>> Have you attempted to "do the right thing" ™?
>>> Which is to add the certificate to a trust store, instead of disabling all
>>> TLS features?
>>>
>>> It's actually not that hard and documented here:
>>> http://typesafehub.github.io/ssl-config/CertificateGeneration.html
>>> <http://typesafehub.github.io/ssl-config/CertificateGeneration.html>
>>>
>>> Also, you can always drop down to the raw low level Java APIs, as this
>>> example shows:
>>> https://github.com/akka/akka/blob/master/akka-http-tests/src/main/java/akka/http/javadsl/server/examples/simple/SimpleServerApp.java
>>>
>>> <https://github.com/akka/akka/blob/master/akka-http-tests/src/main/java/akka/http/javadsl/server/examples/simple/SimpleServerApp.java>
>>> (it's server side, but the same process can be done for client – pretty
>>> much)
>>>
>>> --
>>> Konrad `ktoso` Malawski
>>> Akka <http://akka.io/> @ Lightbend <http://lightbend.com/>
>>> On 18 May 2016 at 01:25:32, Eric Swenson (er...@ <>swenson.org
>>> <http://swenson.org/>) wrote:
>>>
>>>> I have a need (no, not in production) to have an akka-based service
>>>> contact another service using TLS where the remote service is using a
>>>> self-signed cert.
>>>>
>>>> I've used AkkaSSLConfig to configure the "loose" settings:
>>>>
>>>> val looseConfig = SSLLooseConfig().withAcceptAnyCertificate(true).
>>>> withDisableHostnameVerification(true).
>>>> withAllowLegacyHelloMessages(Some(true)).
>>>> withAllowUnsafeRenegotiation(Some(true)).
>>>> withAllowWeakCiphers(true).
>>>> withAllowWeakProtocols(true).
>>>> withDisableSNI(true)
>>>>
>>>> and despite trying all of the, still get the following exception when
>>>> trying to access the remote service:
>>>>
>>>> sun.security.validator.ValidatorException: PKIX path building failed:
>>>> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
>>>> valid certification path to requested target
>>>>
>>>>
>>>>
>>>> It was my impression that the loose config:
>>>>
>>>>
>>>>
>>>> withAcceptAnyCertificate(true)
>>>>
>>>>
>>>>
>>>> should have prevented the TLS implementation from trying to verify the
>>>> cert.
>>>>
>>>>
>>>>
>>>> What am I missing? What the the correct way to accept self-signed certs
>>>> using akka-http's Http() client?
>>>>
>>>>
>>>>
>>>> -- Eric
>>>>
>>>>
>>>>
>>>>
>>>>
>>>>
>>>> --
>>>> >>>>>>>>>> Read the docs: http://akka.io/docs/ <http://akka.io/docs/>
>>>> >>>>>>>>>> Check the FAQ:
>>>> >>>>>>>>>> http://doc.akka.io/docs/akka/current/additional/faq.html
>>>> >>>>>>>>>> <http://doc.akka.io/docs/akka/current/additional/faq.html>
>>>> >>>>>>>>>> Search the archives: https://groups.google.com/group/akka-user
>>>> >>>>>>>>>> <https://groups.google.com/group/akka-user>
>>>> ---
>>>> You received this message because you are subscribed to the Google Groups
>>>> "Akka User List" group.
>>>> To unsubscribe from this group and stop receiving emails from it, send an
>>>> email to akka-user+...@ <>googlegroups.com <http://googlegroups.com/>.
>>>> To post to this group, send email to akka...@ <>googlegroups.com
>>>> <http://googlegroups.com/>.
>>>> Visit this group at https://groups.google.com/group/akka-user
>>>> <https://groups.google.com/group/akka-user>.
>>>> For more options, visit https://groups.google.com/d/optout
>>>> <https://groups.google.com/d/optout>.
>
>
> --
> >>>>>>>>>> Read the docs: http://akka.io/docs/ <http://akka.io/docs/>
> >>>>>>>>>> Check the FAQ:
> >>>>>>>>>> http://doc.akka.io/docs/akka/current/additional/faq.html
> >>>>>>>>>> <http://doc.akka.io/docs/akka/current/additional/faq.html>
> >>>>>>>>>> Search the archives: https://groups.google.com/group/akka-user
> >>>>>>>>>> <https://groups.google.com/group/akka-user>
> ---
> You received this message because you are subscribed to a topic in the Google
> Groups "Akka User List" group.
> To unsubscribe from this topic, visit
> https://groups.google.com/d/topic/akka-user/DjCQP28l52k/unsubscribe
> <https://groups.google.com/d/topic/akka-user/DjCQP28l52k/unsubscribe>.
> To unsubscribe from this group and all its topics, send an email to
> akka-user+unsubscr...@googlegroups.com
> <mailto:akka-user+unsubscr...@googlegroups.com>.
> To post to this group, send email to akka-user@googlegroups.com
> <mailto:akka-user@googlegroups.com>.
> Visit this group at https://groups.google.com/group/akka-user
> <https://groups.google.com/group/akka-user>.
> For more options, visit https://groups.google.com/d/optout
> <https://groups.google.com/d/optout>.
--
>>>>>>>>>> Read the docs: http://akka.io/docs/
>>>>>>>>>> Check the FAQ:
>>>>>>>>>> http://doc.akka.io/docs/akka/current/additional/faq.html
>>>>>>>>>> Search the archives: https://groups.google.com/group/akka-user
---
You received this message because you are subscribed to the Google Groups "Akka
User List" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to akka-user+unsubscr...@googlegroups.com.
To post to this group, send email to akka-user@googlegroups.com.
Visit this group at https://groups.google.com/group/akka-user.
For more options, visit https://groups.google.com/d/optout.
