{"action":"closed","issue":{"url":"https://api.github.com/repos/floragunncom/search-guard-ssl/issues/36","repository_url":"https://api.github.com/repos/floragunncom/search-guard-ssl","labels_url":"https://api.github.com/repos/floragunncom/search-guard-ssl/issues/36/labels{/name}","comments_url":"https://api.github.com/repos/floragunncom/search-guard-ssl/issues/36/comments","events_url":"https://api.github.com/repos/floragunncom/search-guard-ssl/issues/36/events","html_url":"https://github.com/floragunncom/search-guard-ssl/issues/36","id":173554056,"number":36,"title":"Server certificate being emitted twice, preventing host verification","user":{"login":"chmarr","id":523669,"avatar_url":"https://avatars.githubusercontent.com/u/523669?v=3","gravatar_id":"","url":"https://api.github.com/users/chmarr","html_url":"https://github.com/chmarr","followers_url":"https://api.github.com/users/chmarr/followers","following_url":"https://api.github.com/users/chmarr/following{/other_user}","gists_url":"https://api.github.com/users/chmarr/gists{/gist_id}","starred_url":"https://api.github.com/users/chmarr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/chmarr/subscriptions","organizations_url":"https://api.github.com/users/chmarr/orgs","repos_url":"https://api.github.com/users/chmarr/repos","events_url":"https://api.github.com/users/chmarr/events{/privacy}","received_events_url":"https://api.github.com/users/chmarr/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2016-08-26T22:15:37Z","updated_at":"2016-09-05T14:55:24Z","closed_at":"2016-09-05T14:55:24Z","body":"Both the http and transport layers are emitting the server certificate part of the certificate chain twice. Eg, this output from using `openssl -s_client`:\r\n\r\n```\r\n---\r\nCertificate chain\r\n 0 s:/C=US/O=ExampleCo/OU=Example Systems/CN=test1.example.com\r\n   i:/C=US/O= ExampleCo/OU= Example Systems/CN= ExampleCo Intermediate Authority\r\n 1 s:/C=US/O= ExampleCo/OU= Example Systems/CN= ExampleCo Intermediate Authority\r\n   i:/C=US/O= ExampleCo/OU= Example Systems/CN= ExampleCo Root Authority\r\n 2 s:/C=US/O= ExampleCo/OU= Example Systems/CN=test1.example.com\r\n   i:/C=US/O= ExampleCo/OU= Example Systems/CN= ExampleCo Intermediate Authority\r\n---\r\n```\r\n\r\nThis stops a slew of tools working (such as python elasticsearch client, or python requests) when I try to turn on host verification. The culprit is two instances in SSLCertificateHelper.java at line 66, and 79:\r\n\r\n```\r\n            Certificate[] certs = ks.getCertificateChain(alias);\r\n            if(certs != null && certs.length > 0) {\r\n                trustedCerts.addAll(Arrays.asList(certs));\r\n            }\r\n            Certificate cert = ks.getCertificate(alias);\r\n            if(cert != null) {\r\n                trustedCerts.add(cert);\r\n            }\r\n```\r\n\r\nI believe if we just remove the getCertificate, it'll work just fine, since \"getCertificateChain\" pulls out the entire chain from the keystore. Alas I'm not in a good position to test that change fully right now.\r\n\r\nOh, you might notice that the \"self-signed\" root CA in the openssl output is missing. Emitting the root CA is actually unnecessary, since the client _must_ ignore it. Having it in there (and thus inside the keystore) is harmless but adds a bit more network bandwidth. (Actually, the root certificate coupled with the duplicated server certificate caused additional problems, which I alleviated most (not all) by removing the root from the keystore. I suggest that the docs be updated slightly.\r\n\r\nThank you for your consideration!\r\n"}}
{"actor":{"display_login":"floragunncom"}}