akka http SSLConfig issues with Hostname verification and cert validation

Question

I have some issues with Akka http configuration on the client side. I am trying to connect to a server which doesn't provide: - a public signed certificate - a certificate corresponding to the hostname I don't have the hand on this nginx so I cannot change the server side configuration. I can only change the client side.

After lots of investigation on configuring SSL, I have found that I need to configure SSL options in application.conf at two different levels :

akka.ssl-config.ssl.loose.acceptAnyCertificate=true
akka.ssl-config.loose.disableHostnameVerification = true

and

ssl-config.loose.acceptAnyCertificate=true
ssl-config.loose.disableHostnameVerification = true

I have checked the configuration is fine with

log-config-on-start = "on"

The problem is that I still get error at the akka debug level (not very clear)

[ingestionApiClient-akka.actor.default-dispatcher-13] [akka://ingestionApiClient/user/StreamSupervisor-0/flow-216-1-unknown-operation] closing output

Looking at wireshark I have found that's a problem of certificate validation

TLSv1 Record Layer: Alert (Level: Fatal, Description: Certificate Unknown)

I suppose the JVM configuration is overiding all I have done so I also tried to follow this method to modify JVM SSL config : Java SSL: how to disable hostname verification

No problem with configuring the SSLContext and passing it to akka http because I can set the default HttpsContext with

val sc = SSLContext.getInstance("TLS")
*...configuration...*
val customContext =HttpsContext(sc, sslParameters = Some(params))
Http().setDefaultClientHttpsContext(customHttpsContext)

But I cannot find anyway to configure the default hostname verifier. The Http class doesn't have any method like Http().setDefaultHostnameVerifier

This how I connect to the server

val dataIngestFlow = Http().outgoingConnectionTls(config.httpEndpointHost,config.httpEndpointPort)

How can I achieve this ? Thanks a lot for your help

score 0 · Answer 1 · answered May 11 '17 at 08:02

I don't know which version of akka and akka-http you use but have you tried to set the configuration field akka.ssl-config.hostnameVerifierClass to your specific implementation of the HostNameVerifier interface?

The simplest verifier which accepts everything looks like this:

public static class AcceptAllHostNameVerifier implements HostnameVerifier {
  @Override
  public boolean verify(String s, SSLSession sslSession) {
    return true;
  }
}

score 0 · Answer 2 · answered Nov 18 '17 at 12:36

I also got stuck in similar issue and was getting similar errors. with following code I was able to get through:

val trustStoreConfig = TrustStoreConfig(None, Some("/etc/Project/keystore/my.cer")).withStoreType("PEM")
val trustManagerConfig = TrustManagerConfig().withTrustStoreConfigs(List(trustStoreConfig))

val badSslConfig = AkkaSSLConfig().mapSettings(s => s.withLoose(s.loose
  .withAcceptAnyCertificate(true)
  .withDisableHostnameVerification(true)
).withTrustManagerConfig(trustManagerConfig))

val badCtx = Http().createClientHttpsContext(badSslConfig)

Http().superPool[RequestTracker](badCtx)(httpMat)

akka http SSLConfig issues with Hostname verification and cert validation

2 Answers2