Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

TLS Hostname verification doesn't get disabled if using https lookup in PulsarClient #3333

Closed
ivankelly opened this issue Jan 8, 2019 · 3 comments
Labels
area/security help wanted lifecycle/stale type/bug The PR fixed a bug or issue reported a bug

Comments

@ivankelly
Copy link
Contributor

Describe the bug
If you connect to a broker using a https lookup url, and the cert doesn't match the hostname, and hostname verification is disabled, it will complain about the hostname.

To Reproduce
Steps to reproduce the behavior:

  1. Configure a cluster with TLS authentication. The broker hostname shouldn't match the cert CN.
PulsarClient.builder()
            .serviceUrl("https://BROKER_HOSTNAME:8443")
            .enableTlsHostnameVerification(false)
            .authentication("org.apache.pulsar.client.impl.auth.AuthenticationTls",
                                     "tlsCertFile:PATH_TO_CERT,tlsKeyFile:PATH_TO_KEY")
            .tlsTrustCertsFilePath(PATH_TO_CA).build();
  1. The client will fail to connect and give an error about the hostname.

Expected behavior
It shouldn't try to verify the hostname.

@devinbost
Copy link
Contributor

@ivankelly Is this also an issue with

.serviceUrl("pulsar+tls://BROKER_HOSTNAME:6651")

?

@tisonkun
Copy link
Member

tisonkun commented Dec 6, 2022

cc @nodece is it still relevant now?

@nodece
Copy link
Member

nodece commented Dec 6, 2022

Closed by #15824.

@nodece nodece closed this as completed Dec 6, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
area/security help wanted lifecycle/stale type/bug The PR fixed a bug or issue reported a bug
Projects
None yet
Development

No branches or pull requests

6 participants