6 Replies Latest reply on Nov 1, 2018 2:15 AM by mchoma

https-remoting with customized TrustManager broken after upgrade to WildFly 11?

yashendrac Oct 14, 2018 8:22 PM

We are securing http-remoting by using self-signed certificate and our custom TrustManager. To point to our TrustManager and truststore dynamically at wildfly start, we have following code in a startup ejb class:

Security.addProvider(new MySecurityProvider());

Security.setProperty("ssl.KeyManagerFactory.algorithm", ......);

Security.setProperty("ssl.TrustManagerFactory.algorithm", .....);

System.setProperty("javax.net.ssl.keyStoreType", .....);

System.setProperty("javax.net.ssl.trustStoreType", .....);

It all work fine with WindFly 10 and it uses out trustmanager but exectly same code and configuration doesnt work with WildFly 11.

Despite setting all the system and security properties mentioned above, WildFly 11 uses default JKS truststore and jdk's default jre\lib\security\cacerts file.

It appear the subsystem from WildFly 11(and WildFly 12) doesn't honor the system and security properties settings above?

WildFly will point to my truststore file if I have specified trust-store-path as part of http-acceptor

<http-acceptor name="http-acceptor" http-listener="default-ssl">

<param name="trust-store-path" value="${jboss.server.config.dir}/keystore.jks"/>

</http-acceptor>

But I want it to point to my TrustManagerFactory, and TrustManager.

Any help is appreciated.

This is the stacktrace from WildFly 12

javax.naming.CommunicationException: WFNAM00018: Failed to connect to remote host [Root exception is javax.net.ssl.SSLHandshakeException: General SSLEngine problem]

at org.wildfly.naming.client.remote.RemoteNamingProvider.getPeerIdentityForNaming(RemoteNamingProvider.java:110)

at org.wildfly.naming.client.remote.RemoteNamingProvider.getPeerIdentityForNaming(RemoteNamingProvider.java:53)

at org.wildfly.naming.client.NamingProvider.getPeerIdentityForNamingUsingRetry(NamingProvider.java:105)

at org.wildfly.naming.client.remote.RemoteNamingProvider.getPeerIdentityForNamingUsingRetry(RemoteNamingProvider.java:91)

at org.wildfly.naming.client.remote.RemoteContext.lambda$lookupNative$0(RemoteContext.java:189)

at org.wildfly.naming.client.NamingProvider.performExceptionAction(NamingProvider.java:222)

at org.wildfly.naming.client.remote.RemoteContext.performWithRetry(RemoteContext.java:100)

at org.wildfly.naming.client.remote.RemoteContext.lookupNative(RemoteContext.java:188)

at org.wildfly.naming.client.AbstractFederatingContext.lookup(AbstractFederatingContext.java:74)

at org.wildfly.naming.client.AbstractFederatingContext.lookup(AbstractFederatingContext.java:60)

at org.wildfly.naming.client.WildFlyRootContext.lookup(WildFlyRootContext.java:144)

at javax.naming.InitialContext.lookup(InitialContext.java:417)

...........

at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)

at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)

at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)

at java.lang.reflect.Method.invoke(Method.java:498)

at org.jboss.as.ee.component.ManagedReferenceMethodInterceptor.processInvocation(ManagedReferenceMethodInterceptor.java:52)