Uploaded image for project: 'JBoss Enterprise Application Platform'
  1. JBoss Enterprise Application Platform
  2. JBEAP-24157

[GSS](7.4.z) WEJBHTTP-74 - The http ejb client should use the servers hostname for the TLS SNI extension during handshake


    • Icon: Bug Bug
    • Resolution: Done
    • Icon: Major Major
    • 7.4.10.CR1, 7.4.10.GA
    • None
    • EJB
    • None

      Currently the IP address of the server used for the Server Name Indication (SNI) during the handshake. In setups with multiple virtual severs on the same IP the handshake might fail.



      Quotes from Transport Layer Security (TLS) Extensions: Extension Definitions RFC:

      3. Server Name Indication

      TLS does not provide a mechanism for a client to tell a server the name of the server it is contacting.  It may be desirable for clients to provide this information to facilitate secure connections to servers that host multiple 'virtual' servers at a single underlying network address… 


      … "HostName" contains the fully qualified DNS hostname of the server, as understood by the client… 


      … Literal IPv4 and IPv6 addresses are not permitted in "HostName”…

      Source: https://datatracker.ietf.org/doc/html/rfc6066#page-6


      In our setup we use a single Apache httpd to load balance several virtual servers with different DNS records, so when the client uses the IP address of the Apache load balancer during the handshake, the Apache server doesn’t know which virtual server the client is attempting to connect to and the connection is dropped by Apache during the handshake.

      So far we have worked around the issue by patching the HttpConnectionPool to use the hostname instead IP when creating connections. This of course breaks the HostPool in setups where multiple IPs serve a single DNS, but in our case that's not an issue.

            rhn-support-rmartinc Ricardo Martin Camarero
            rhn-support-bmaxwell Brad Maxwell
            0 Vote for this issue
            7 Start watching this issue