[aerogear-dev] UPS Java Client should support client authentication

[Stefan Miklosovic]

Hi,

we are doing HTTPS tests on UPS integration tests where UPS Java client is used to send some payload to UPS, it seems it is not sufficient to have only plain HTTP sender when we are sending it to HTTPS endpoint.

When JBoss AS is set up with keystore and truststore in https connector for web subsystem like this:

<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true">
    <ssl name="aerogear-ssl" key-alias="aerogear" 
        password="aerogear"
        certificate-key-file="${jboss.server.config.dir}/aerogear.keystore"
        protocol="ALL"
        verify-client="none"
        certificate-file="${jboss.server.config.dir}/aerogear.keystore"
        ca-certificate-file="${jboss.server.config.dir}/aerogear.truststore"/>
</connector>

and UPS Java client sends some payload (with HttpUrlConnection, not secure connection), this exception is thown from it:

SEVERE: Send did not succeed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

This basically means that server was not able to mark that connection as trusted.

In order to use custom trustStore and trustStorePassword, they are propagated to test like system properties

System.setProperty("javax.net.ssl.trustStore", "aerogear.truststore");
System.setProperty("javax.net.ssl.trustStorePassword", "aerogear");

however any attempt to set them in test itself like that is not successful since it is "too late". When they are set like -D properties with maven, it is executed without any problems.

This does not work as well https://github.com/aerogear/aerogear-unifiedpush-java-client#known-issues since we are not using jsse (and can not) because of this issue https://issues.jboss.org/browse/JBPAPP6-711 which was repaired in 7.1.2 and that release is not community release anymore so we can not base tests on EAP and we are running them on 7.1.1. (we can not run them on WF as well since it is not compatible with EAP but 7.1.1 is).

So this is chicken-egg problem. When verify-client is "none" plain http from UPS Java client is not validated. When we do want client authentication (verify-client=want/true), UPS sender is not https aware. Additionally, we can not use "jsse" due to JBPAPP6-711.

Ideas?

Stefan Miklosovic
Red Hat Brno - JBoss Mobile Platform

e-mail: smikloso at redhat.com
irc: smikloso