{"action":"created","issue":{"url":"https://api.github.com/repos/akka/akka/issues/15883","repository_url":"https://api.github.com/repos/akka/akka","labels_url":"https://api.github.com/repos/akka/akka/issues/15883/labels{/name}","comments_url":"https://api.github.com/repos/akka/akka/issues/15883/comments","events_url":"https://api.github.com/repos/akka/akka/issues/15883/events","html_url":"https://github.com/akka/akka/issues/15883","id":42657589,"number":15883,"title":"TLS support should do peer verification","user":{"login":"wsargent","id":71236,"avatar_url":"https://avatars.githubusercontent.com/u/71236?v=3","gravatar_id":"","url":"https://api.github.com/users/wsargent","html_url":"https://github.com/wsargent","followers_url":"https://api.github.com/users/wsargent/followers","following_url":"https://api.github.com/users/wsargent/following{/other_user}","gists_url":"https://api.github.com/users/wsargent/gists{/gist_id}","starred_url":"https://api.github.com/users/wsargent/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wsargent/subscriptions","organizations_url":"https://api.github.com/users/wsargent/orgs","repos_url":"https://api.github.com/users/wsargent/repos","events_url":"https://api.github.com/users/wsargent/events{/privacy}","received_events_url":"https://api.github.com/users/wsargent/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/akka/akka/labels/1%20-%20triaged","name":"1 - triaged","color":"5319e7"},{"url":"https://api.github.com/repos/akka/akka/labels/t:http","name":"t:http","color":"CCCCCC"},{"url":"https://api.github.com/repos/akka/akka/labels/t:io","name":"t:io","color":"ededed"},{"url":"https://api.github.com/repos/akka/akka/labels/t:io:tls","name":"t:io:tls","color":"ededed"},{"url":"https://api.github.com/repos/akka/akka/labels/t:stream","name":"t:stream","color":"cccccc"}],"state":"closed","locked":false,"assignee":null,"milestone":{"url":"https://api.github.com/repos/akka/akka/milestones/67","html_url":"https://github.com/akka/akka/milestones/stream-backlog","labels_url":"https://api.github.com/repos/akka/akka/milestones/67/labels","id":1450036,"number":67,"title":"stream-backlog","description":"","creator":{"login":"drewhk","id":932285,"avatar_url":"https://avatars.githubusercontent.com/u/932285?v=3","gravatar_id":"","url":"https://api.github.com/users/drewhk","html_url":"https://github.com/drewhk","followers_url":"https://api.github.com/users/drewhk/followers","following_url":"https://api.github.com/users/drewhk/following{/other_user}","gists_url":"https://api.github.com/users/drewhk/gists{/gist_id}","starred_url":"https://api.github.com/users/drewhk/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/drewhk/subscriptions","organizations_url":"https://api.github.com/users/drewhk/orgs","repos_url":"https://api.github.com/users/drewhk/repos","events_url":"https://api.github.com/users/drewhk/events{/privacy}","received_events_url":"https://api.github.com/users/drewhk/received_events","type":"User","site_admin":false},"open_issues":136,"closed_issues":8,"state":"open","created_at":"2015-12-08T14:55:19Z","updated_at":"2016-03-21T13:11:23Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2014-09-12T18:35:42Z","updated_at":"2016-03-21T15:12:44Z","closed_at":"2016-03-21T13:11:23Z","body":"TLS needs some kind of peer verification in order to be secure, but that verification generally exists on the application protocol layer (HTTPS, LDAPS, ESMTPS) rather than the TLS layer itself.  Typically the peer is verified through the DNS hostname against the X.509 certificate -- see http://tersesystems.com/2014/03/23/fixing-hostname-verification/ for details.\r\n\r\nJSSE provides the SSLEngine / SSLSocket layer for protocol developers, but notes that anyone using SSLSocket must verify the peer themselves:\r\nhttp://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/JSSERefGuide.html#ciphersuitechoice\r\n\r\nSslTlsCipher uses SSLEngine directly and does not verify the peer, so either it needs a warning or a HostnameVerifier on it:\r\n\r\nhttps://github.com/akka/akka/blob/release-2.3-dev/akka-stream/src/main/scala/akka/stream/io/SslTlsCipher.scala\r\n\r\nPlease check any fixes against a DNS proxy such as dnschef for verification -- see http://tersesystems.com/2014/03/31/testing-hostname-verification/ for details.\r\n"},"comment":{"url":"https://api.github.com/repos/akka/akka/issues/comments/199331954","html_url":"https://github.com/akka/akka/issues/15883#issuecomment-199331954","issue_url":"https://api.github.com/repos/akka/akka/issues/15883","id":199331954,"user":{"login":"ktoso","id":120979,"avatar_url":"https://avatars.githubusercontent.com/u/120979?v=3","gravatar_id":"","url":"https://api.github.com/users/ktoso","html_url":"https://github.com/ktoso","followers_url":"https://api.github.com/users/ktoso/followers","following_url":"https://api.github.com/users/ktoso/following{/other_user}","gists_url":"https://api.github.com/users/ktoso/gists{/gist_id}","starred_url":"https://api.github.com/users/ktoso/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ktoso/subscriptions","organizations_url":"https://api.github.com/users/ktoso/orgs","repos_url":"https://api.github.com/users/ktoso/repos","events_url":"https://api.github.com/users/ktoso/events{/privacy}","received_events_url":"https://api.github.com/users/ktoso/received_events","type":"User","site_admin":false},"created_at":"2016-03-21T15:12:44Z","updated_at":"2016-03-21T15:12:44Z","body":"Excellent, thanks!"}}