[jira] [Commented] (QPID-7567) [Java Broker] Select appropriate certificate for TLS based on SNIServerName
[ https://issues.apache.org/jira/browse/QPID-7567?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16413862#comment-16413862 ] Keith Wall commented on QPID-7567: -- Alex - changes made by a7e1057 look reasonable to me. > [Java Broker] Select appropriate certificate for TLS based on SNIServerName > --- > > Key: QPID-7567 > URL: https://issues.apache.org/jira/browse/QPID-7567 > Project: Qpid > Issue Type: Improvement > Components: Broker-J >Reporter: Keith Wall >Assignee: Keith Wall >Priority: Major > Fix For: qpid-java-broker-7.1.0 > > > Enable SNI support for the Java Broker. > We will need a X509ExtendedKeyManager implementation that gets the > SNIServerName from the SSL handshakes and then selects the most appropriate > certificate alias for the indicated hostname. > I found the following example helpful: > https://github.com/grahamedgecombe/netty-sni-example/blob/master/src/main/java/SniKeyManager.java > https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html > This change requires Java 8, but it is probably possible to retain support > for Java 7 using reflection. > It looks to me like the clients (Qpid JMS Client and Legacy) require no > changes. They both pass the hostname through to the SSLEngine, so the > SNIServerName should already be passed through. Client side support in Java > was added at Java 7. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org For additional commands, e-mail: dev-h...@qpid.apache.org
[jira] [Commented] (QPID-7567) [Java Broker] Select appropriate certificate for TLS based on SNIServerName
[ https://issues.apache.org/jira/browse/QPID-7567?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16411992#comment-16411992 ] ASF subversion and git services commented on QPID-7567: --- Commit a7e1057513e8f5e369c96fc080ae457c60e2dae5 in qpid-broker-j's branch refs/heads/master from [~alex.rufous] [ https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=a7e1057 ] QPID-7567: [Broker-J] Add UI and documentation for the feature > [Java Broker] Select appropriate certificate for TLS based on SNIServerName > --- > > Key: QPID-7567 > URL: https://issues.apache.org/jira/browse/QPID-7567 > Project: Qpid > Issue Type: Improvement > Components: Broker-J >Reporter: Keith Wall >Assignee: Keith Wall >Priority: Major > Fix For: qpid-java-broker-7.1.0 > > > Enable SNI support for the Java Broker. > We will need a X509ExtendedKeyManager implementation that gets the > SNIServerName from the SSL handshakes and then selects the most appropriate > certificate alias for the indicated hostname. > I found the following example helpful: > https://github.com/grahamedgecombe/netty-sni-example/blob/master/src/main/java/SniKeyManager.java > https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html > This change requires Java 8, but it is probably possible to retain support > for Java 7 using reflection. > It looks to me like the clients (Qpid JMS Client and Legacy) require no > changes. They both pass the hostname through to the SSLEngine, so the > SNIServerName should already be passed through. Client side support in Java > was added at Java 7. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org For additional commands, e-mail: dev-h...@qpid.apache.org
[jira] [Commented] (QPID-7567) [Java Broker] Select appropriate certificate for TLS based on SNIServerName
[ https://issues.apache.org/jira/browse/QPID-7567?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16411174#comment-16411174 ] Rob Godfrey commented on QPID-7567: --- Yeah - I basically decided that if you have multiple valid certificates for a server name then any one of them should do; and if you only want to send the one associated with a particular alias, you should not have added the other certificates into your store. The alias is there only for the case where a valid certificate can't be found (for whatever reason). > [Java Broker] Select appropriate certificate for TLS based on SNIServerName > --- > > Key: QPID-7567 > URL: https://issues.apache.org/jira/browse/QPID-7567 > Project: Qpid > Issue Type: Improvement > Components: Broker-J >Reporter: Keith Wall >Assignee: Keith Wall >Priority: Major > Fix For: qpid-java-broker-7.1.0 > > > Enable SNI support for the Java Broker. > We will need a X509ExtendedKeyManager implementation that gets the > SNIServerName from the SSL handshakes and then selects the most appropriate > certificate alias for the indicated hostname. > I found the following example helpful: > https://github.com/grahamedgecombe/netty-sni-example/blob/master/src/main/java/SniKeyManager.java > https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html > This change requires Java 8, but it is probably possible to retain support > for Java 7 using reflection. > It looks to me like the clients (Qpid JMS Client and Legacy) require no > changes. They both pass the hostname through to the SSLEngine, so the > SNIServerName should already be passed through. Client side support in Java > was added at Java 7. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org For additional commands, e-mail: dev-h...@qpid.apache.org
[jira] [Commented] (QPID-7567) [Java Broker] Select appropriate certificate for TLS based on SNIServerName
[
https://issues.apache.org/jira/browse/QPID-7567?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16411083#comment-16411083
]
Alex Rudyy commented on QPID-7567:
--
Rob,
I looked through the changes committed under [
https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=09d7d8a ]. They
look good to me. Though, I am wondering whether {{QpidBestFitX509KeyManager}}
should be able to deal with the case when several certificates with the same
SNI are provided and alias is used to identify the certificate to use. To be
fair, I am not sure that it is a valid use case and I cannot imagine the
situation where it can be required. Thus, I do not have a strong opinion
whether keystore should use alias to select certificate among multiple
certificates with the same SNI. What do you think about it?
> [Java Broker] Select appropriate certificate for TLS based on SNIServerName
> ---
>
> Key: QPID-7567
> URL: https://issues.apache.org/jira/browse/QPID-7567
> Project: Qpid
> Issue Type: Improvement
> Components: Broker-J
>Reporter: Keith Wall
>Assignee: Keith Wall
>Priority: Major
> Fix For: qpid-java-broker-7.1.0
>
>
> Enable SNI support for the Java Broker.
> We will need a X509ExtendedKeyManager implementation that gets the
> SNIServerName from the SSL handshakes and then selects the most appropriate
> certificate alias for the indicated hostname.
> I found the following example helpful:
> https://github.com/grahamedgecombe/netty-sni-example/blob/master/src/main/java/SniKeyManager.java
> https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html
> This change requires Java 8, but it is probably possible to retain support
> for Java 7 using reflection.
> It looks to me like the clients (Qpid JMS Client and Legacy) require no
> changes. They both pass the hostname through to the SSLEngine, so the
> SNIServerName should already be passed through. Client side support in Java
> was added at Java 7.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
-
To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org
For additional commands, e-mail: dev-h...@qpid.apache.org
[jira] [Commented] (QPID-7567) [Java Broker] Select appropriate certificate for TLS based on SNIServerName
[ https://issues.apache.org/jira/browse/QPID-7567?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16404749#comment-16404749 ] ASF subversion and git services commented on QPID-7567: --- Commit ac9069ac8cc300ca78e7ef1461de5b2eefb4fe46 in qpid-broker-j's branch refs/heads/master from [~k-wall] [ https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=ac9069a ] QPID-7567 : [Broker-J] Delegate consistently to underlying KeyManager > [Java Broker] Select appropriate certificate for TLS based on SNIServerName > --- > > Key: QPID-7567 > URL: https://issues.apache.org/jira/browse/QPID-7567 > Project: Qpid > Issue Type: Improvement > Components: Broker-J >Reporter: Keith Wall >Assignee: Keith Wall >Priority: Major > Fix For: qpid-java-broker-7.1.0 > > > Enable SNI support for the Java Broker. > We will need a X509ExtendedKeyManager implementation that gets the > SNIServerName from the SSL handshakes and then selects the most appropriate > certificate alias for the indicated hostname. > I found the following example helpful: > https://github.com/grahamedgecombe/netty-sni-example/blob/master/src/main/java/SniKeyManager.java > https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html > This change requires Java 8, but it is probably possible to retain support > for Java 7 using reflection. > It looks to me like the clients (Qpid JMS Client and Legacy) require no > changes. They both pass the hostname through to the SSLEngine, so the > SNIServerName should already be passed through. Client side support in Java > was added at Java 7. -- This message was sent by Atlassian JIRA (v7.6.3#76005) - To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org For additional commands, e-mail: dev-h...@qpid.apache.org
[jira] [Commented] (QPID-7567) [Java Broker] Select appropriate certificate for TLS based on SNIServerName
[ https://issues.apache.org/jira/browse/QPID-7567?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=16266037#comment-16266037 ] ASF subversion and git services commented on QPID-7567: --- Commit 09d7d8a19ed4e35d99c1b82e5e86aa135ea63c50 in qpid-broker-j's branch refs/heads/master from [~godfrer] [ https://git-wip-us.apache.org/repos/asf?p=qpid-broker-j.git;h=09d7d8a ] QPID-7567 : Use SNI to select appropriate keystore alias > [Java Broker] Select appropriate certificate for TLS based on SNIServerName > --- > > Key: QPID-7567 > URL: https://issues.apache.org/jira/browse/QPID-7567 > Project: Qpid > Issue Type: Improvement > Components: Broker-J >Reporter: Keith Wall > Fix For: Future > > > Enable SNI support for the Java Broker. > We will need a X509ExtendedKeyManager implementation that gets the > SNIServerName from the SSL handshakes and then selects the most appropriate > certificate alias for the indicated hostname. > I found the following example helpful: > https://github.com/grahamedgecombe/netty-sni-example/blob/master/src/main/java/SniKeyManager.java > https://docs.oracle.com/javase/8/docs/technotes/guides/security/enhancements-8.html > This change requires Java 8, but it is probably possible to retain support > for Java 7 using reflection. > It looks to me like the clients (Qpid JMS Client and Legacy) require no > changes. They both pass the hostname through to the SSLEngine, so the > SNIServerName should already be passed through. Client side support in Java > was added at Java 7. -- This message was sent by Atlassian JIRA (v6.4.14#64029) - To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org For additional commands, e-mail: dev-h...@qpid.apache.org
