Disabling hostname checking for connecting via SSL

[agarman]

Attempting to connect to compose.io etcd service using example in SssTest.java. It looks like compose.io uses certificates that do not matchDNS. Is there a way to disable HostnameChecker exposed by ClientBuilder or GrpcSslContexts?

CertificateException No subject alternative DNS name matching etcd found.
	sun.security.util.HostnameChecker.matchDNS (HostnameChecker.java:204)
	sun.security.util.HostnameChecker.match (HostnameChecker.java:95)
	sun.security.ssl.X509TrustManagerImpl.checkIdentity (X509TrustManagerImpl.java:455)
	sun.security.ssl.X509TrustManagerImpl.checkIdentity (X509TrustManagerImpl.java:436)
	sun.security.ssl.X509TrustManagerImpl.checkTrusted (X509TrustManagerImpl.java:252)
sun.security.ssl.X509TrustManagerImpl.checkServerTrusted (X509TrustManagerImpl.java:136)
io.netty.handler.ssl.ReferenceCountedOpenSslClientContext$ExtendedTrustManagerVerifyCallback.verify (ReferenceCountedOpenSslClientContext.java:221)
io.netty.handler.ssl.ReferenceCountedOpenSslContext$AbstractCertificateVerifier.verify (ReferenceCountedOpenSslContext.java:644)
io.netty.internal.tcnative.SSL.readFromSSL (SSL.java:-2)
io.netty.handler.ssl.ReferenceCountedOpenSslEngine.readPlaintextData (ReferenceCountedOpenSslEngine.java:482)
io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap (ReferenceCountedOpenSslEngine.java:1020)
io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap (ReferenceCountedOpenSslEngine.java:1127)

[lburgazzoli]

You can set the right authority via the builder:

https://github.com/coreos/jetcd/blob/master/jetcd-core/src/test/java/com/coreos/jetcd/internal/impl/SslTest.java#L46

[agarman]

@lburgazzoli thanks - looks like I need to use a SNAPSHOT to get access to that.

[kingpong]

@lburgazzoli How should one set the authority correctly when there are multiple endpoints, each with distinct name and certificate?

[lburgazzoli]

I think there was a discussion about this issue on grpc-java about this so I need to check what solution has been implemented and reflect it on jetcd but I had no time so far. The issue is on how the grpc-java NameResolver.

[agarman]

Re-opening as this is still not usable. Authority needs to be set per endpoint.

[lburgazzoli]

@agarman I'm not sure about what we can do on jetcd side, see the following conversations:

• [WIP] core: Allow LoadBalancer2 to use a different authority per SubChannel grpc/grpc-java#2662
• https://groups.google.com/forum/#!msg/grpc-io/xtwACYjZ2p8/Vg23_VTSAAAJ
• Changes to support client-side load-balancing with Eureka and GRPC Java. ExampleDriven/spring-boot-grpc-example#3

[lburgazzoli]

@agarman @kingpong I think I need to wait for grpc/grpc-java#4469 to be implemented to provide a solution.

[agarman]

@lburgazzoli understood

[github-actions]

This issue is stale because it has been open 60 days with no activity.
Remove stale label or comment or this will be closed in 7 days.

[im-bravo]

I updated the library version to the latest version （0.5.3） to solve this problem
https://mvnrepository.com/artifact/io.etcd/jetcd-all