How to ignore "localhost" in Apache HttpClient using TLSv1.2?

Question

I've tested several syntax constructions for Apache HttpClinet (HTTPS & TLS) in order to ignore the certificate chain for self-signed certificates typically used in "localhost" configurations. There is a custom HttpClient that works well for TLSv1.1 but watching the server traces, it does not trigger use of TLSv1.2, which is the desired security algorithm.

Below you find an attempt to configure the HttpClient using TLSv1.2.

Suggestions for other constructions are welcome. The "localhost" scenario remains a usual mechanism for the development of peer-to-peer routines. Would be nice to have a configurable routine that accepts self-signed certificates for localhost access only.

TLSv1.1 example and using custom HttpClient (Works OK for TLSv1.1 but does not work for TLSv1.2):

HttpClient client = HttpClients.custom().setSSLHostnameVerifier(new NoopHostnameVerifier()).setSslcontext(new SSLContextBuilder().loadTrustMaterial(null, (x509Certificates, s) -> true).build()).build();

Server Log:

*** Finished
verify_data:  { 251, 245, 220, 174, 235, 125, 248, 119, 220, 80, 38, 1 }
***
Thread-7, WRITE: TLSv1 Handshake, length = 48
%% Cached server session: [Session-23, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA]
Thread-7, WRITE: TLSv1 Application Data, length = 108
Thread-7, WRITE: TLSv1 Application Data, length = 1
Thread-7, WRITE: TLSv1 Application Data, length = 19

Client - OK

Debug HTTP response: HttpResponseProxy{HTTP/1.1 200 OK [Date: Tue, 21 Feb 2017 21:16:02 GMT, Access-control-allow-origin: *, Content-length: 20] ResponseEntityProxy{[Content-Length: 20,Chunked: false]}}
*** end of debug ***
Service HTTP Response Code : 200
contentLength is: 20
serviceResponse : This is the response

Testing with TLSv1.2 and code

  SSLContext sslContext = SSLContexts.custom().build();
     SSLConnectionSocketFactory sslConnectionSocketFactory = new SSLConnectionSocketFactory(sslContext,
          new String[]{"TLSv1.2"}, null, SSLConnectionSocketFactory.getDefaultHostnameVerifier());
     HttpClient client = HttpClients.custom().setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE).setConnectionManager(clientConnectionManager).build();

(*) SSLContext class is deprecated

server log:

-Djavax.net.debug=ssl
or 
System.setProperty("javax.net.debug", "ssl");

JsseJCE:  Using MAC HmacSHA256 from provider TBD via init 
MAC:  Using MessageDigest HmacSHA256 from provider IBMJCE version 1.8
*** Finished
verify_data:  { 69, 241, 3, 42, 44, 222, 21, 174, 250, 83, 244, 25 }
***
Thread-7, WRITE: TLSv1.2 Handshake, length = 80
%% Cached server session: [Session-21, SSL_ECDHE_RSA_WITH_AES_128_CBC_SHA256]
Thread-7, READ: TLSv1.2 Alert, length = 64
Thread-7, RECV TLSv1.2 ALERT:  warning, close_notify

Error at the client:

sh ./runit.sh 
javax.net.ssl.SSLPeerUnverifiedException: Host name 'localhost' does not match the certificate subject provided by the peer (CN=My Name, OU=RED, O=RED Brazil, L=MYCITY, ST=SP, C=BR)

score 0 · Accepted Answer · answered Feb 24 '17 at 22:15

The following construction managed to connect with TLSv1.2 using a localhost certificate:

 // solution for localhost certificates and TLSv1.2
 // copied from: http://stackoverflow.com/questions/34655031/javax-net-ssl-sslpeerunverifiedexception-host-name-does-not-match-the-certifica/34657512
 // thanks  

      final SSLConnectionSocketFactory sslsf;
        try {
                sslsf = new SSLConnectionSocketFactory(SSLContext.getDefault(),
                    NoopHostnameVerifier.INSTANCE);
        } catch (NoSuchAlgorithmException e) {
             throw new RuntimeException(e);
        }

      final Registry<ConnectionSocketFactory> registry = RegistryBuilder.<ConnectionSocketFactory>create()
              .register("http", new PlainConnectionSocketFactory())
            .register("https", sslsf)
            .build();

      // HttpClient client; 
      final PoolingHttpClientConnectionManager cm = new PoolingHttpClientConnectionManager(registry);
        cm.setMaxTotal(100);
        HttpClient client = HttpClients.custom()
                .setSSLSocketFactory(sslsf)
                .setConnectionManager(cm)
                .build();
      // end of solution for localhost bypass

How to ignore "localhost" in Apache HttpClient using TLSv1.2?

1 Answers1