moresandeep opened a new pull request, #1461: URL: https://github.com/apache/knox/pull/1461
[KNOX-3519](https://issues.apache.org/jira/browse/KNOX-3519) - Set the JWKS host on the TLS socket so HTTPS endpoint identification works under BC-FIPS ## What changes were proposed in this pull request? Fetching a JWKS over HTTPS fails before any certificate is examined: ``` java.security.cert.CertificateException: No hostname specified for HTTPS endpoint ID check at org.bouncycastle.jsse.provider.HostnameUtil.checkHostname(HostnameUtil.java:31) at org.bouncycastle.jsse.provider.ProvX509TrustManager.checkEndpointID(ProvX509TrustManager.java:333) ``` JWT verification then fails and the request is rejected with 401, even when the JWKS endpoint's certificate is fully trusted and carries a matching SAN. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
