[JBoss JIRA] (WFLY-9921) Unable to create SSL connection if expired certificate chain used
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/WFLY-9921?page=com.atlassian.jira.plugin.... ]
Jan Kalina reassigned WFLY-9921:
--------------------------------
Assignee: Jan Kalina
> Unable to create SSL connection if expired certificate chain used
> -----------------------------------------------------------------
>
> Key: WFLY-9921
> URL: https://issues.jboss.org/browse/WFLY-9921
> Project: WildFly
> Issue Type: Bug
> Components: Security
> Affects Versions: 12.0.0.CR1
> Reporter: Martin Choma
> Assignee: Jan Kalina
> Attachments: ssl_handshake_CA.log, ssl_handshake_certificate.log
>
>
> Reproducer:
> * Server secured by certificate chain, it means Certificate is signed with Intermediate CA which is signed by root CA.
> * Server certificate is expired
> * Client has Intermediate CA in Elytron truststore
> * SSL handshake fails using Elytron client ssl context:
> {code}
> 18:27:54,540 INFO [stdout] (default task-1) default task-1, SEND TLSv1 ALERT: fatal, description = certificate_unknown
> 18:27:54,540 INFO [stdout] (default task-1) default task-1, WRITE: TLSv1 Alert, length = 2
> 18:27:54,540 INFO [stdout] (default task-1) [Raw write]: length = 7
> 18:27:54,540 INFO [stdout] (default task-1) 0000: 15 03 01 00 02 02 2E .......
> 18:27:54,541 INFO [stdout] (default task-1) default task-1, called closeSocket()
> 18:27:54,541 INFO [stdout] (default task-1) default task-1, handling exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateExpiredException: NotAfter: Sat Dec 16 10:49:56 CET 2017
> {code}
> Full SSL handshake log is in attached ssl_handshake_CA.log
> * If I put expired certificate itself into truststore SSL handshake pass, although warning is logged.
> {code}
> 18:35:28,648 WARN [org.wildfly.extension.elytron] (MSC service thread 1-8) WFLYELY00024: Certificate [cn=rhds05.mw.lab.eng.bos.redhat.com, ou=engineering operations, o="red hat, inc.", st=north carolina, c=us] in KeyStore is not valid: java.security.cert.CertificateExpiredException: NotAfter: Sat Dec 16 12:39:06 CET 2017
> at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:274)
> at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:629)
> at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:602)
> at org.wildfly.extension.elytron.KeyStoreService.checkCertificatesValidity(KeyStoreService.java:177)
> at org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:140)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1701)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1680)
> at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1527)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1979)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1481)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1374)
> at java.lang.Thread.run(Thread.java:748)
> {code}
> Full SSL handshake log is in attached ssl_handshake_certificate.log
> So behaviour in these 2 cases is inconsistent. I think we have agreed before we let pass SSL handshake with expired certificate but warn about it in log [1].
> [1] https://issues.jboss.org/browse/JBEAP-6157
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months
[JBoss JIRA] (WFCORE-3103) Embedded server doesn't close open file handles
by Jan Blizňák (JIRA)
[ https://issues.jboss.org/browse/WFCORE-3103?page=com.atlassian.jira.plugi... ]
Jan Blizňák commented on WFCORE-3103:
-------------------------------------
Is there any progress/update on this?
> Embedded server doesn't close open file handles
> -----------------------------------------------
>
> Key: WFCORE-3103
> URL: https://issues.jboss.org/browse/WFCORE-3103
> Project: WildFly Core
> Issue Type: Bug
> Components: CLI, Modules
> Reporter: Jan Blizňák
> Assignee: ehsavoie Hugonnet
>
> When embedded server is started programatically (eg. via CLI wrapper) with specified jboss home, JARs from that path are opened via classloader. But these open handles are never released even after embedded server is stopped.
> This causes problem in situation eg. when you want to delete that jboss home. This is exactly one of the scenarios used in EAP installer, you are not allowed to delete open files on Windows - see JBEAP-1404.
> I created a simple project that reproduce the issue with arbitrary EAP/WF distribution https://github.com/jbliznak/embedded-server-filelocking
> Run it with:
> mvn clean test "-Dwildfly.home=C:\dev\jboss-eap-7.1" "-Denforcer.skip" -Dtest=ModulesFileLockingTestCase
> Manual steps to reproduce in Java code:
> * start a CLI wrapper
> * start embed-server from given server path
> * stop embed-server
> * terminate CLI wrapper
> * try to delete given server path
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months
[JBoss JIRA] (ELY-1528) Unable to create SSL connection if expired certificate chain used
by Jan Kalina (JIRA)
[ https://issues.jboss.org/browse/ELY-1528?page=com.atlassian.jira.plugin.s... ]
Jan Kalina reassigned ELY-1528:
-------------------------------
Assignee: Jan Kalina
> Unable to create SSL connection if expired certificate chain used
> -----------------------------------------------------------------
>
> Key: ELY-1528
> URL: https://issues.jboss.org/browse/ELY-1528
> Project: WildFly Elytron
> Issue Type: Bug
> Components: SSL
> Affects Versions: 1.2.1.Final
> Reporter: Martin Choma
> Assignee: Jan Kalina
>
> Reproducer:
> * Server secured by certificate chain, it means Certificate is signed with Intermediate CA which is signed by root CA.
> * Server certificate is expired
> * Client has Intermediate CA in Elytron truststore
> * SSL handshake fails using Elytron client ssl context:
> {code}
> 18:27:54,540 INFO [stdout] (default task-1) default task-1, SEND TLSv1 ALERT: fatal, description = certificate_unknown
> 18:27:54,540 INFO [stdout] (default task-1) default task-1, WRITE: TLSv1 Alert, length = 2
> 18:27:54,540 INFO [stdout] (default task-1) [Raw write]: length = 7
> 18:27:54,540 INFO [stdout] (default task-1) 0000: 15 03 01 00 02 02 2E .......
> 18:27:54,541 INFO [stdout] (default task-1) default task-1, called closeSocket()
> 18:27:54,541 INFO [stdout] (default task-1) default task-1, handling exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateExpiredException: NotAfter: Sat Dec 16 10:49:56 CET 2017
> {code}
> Full SSL handshake log is in attached ssl_handshake_CA.log
> * If I put expired certificate itself into truststore SSL handshake pass, although warning is logged.
> {code}
> 18:35:28,648 WARN [org.wildfly.extension.elytron] (MSC service thread 1-8) WFLYELY00024: Certificate [cn=rhds05.mw.lab.eng.bos.redhat.com, ou=engineering operations, o="red hat, inc.", st=north carolina, c=us] in KeyStore is not valid: java.security.cert.CertificateExpiredException: NotAfter: Sat Dec 16 12:39:06 CET 2017
> at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:274)
> at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:629)
> at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:602)
> at org.wildfly.extension.elytron.KeyStoreService.checkCertificatesValidity(KeyStoreService.java:177)
> at org.wildfly.extension.elytron.KeyStoreService.start(KeyStoreService.java:140)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.startService(ServiceControllerImpl.java:1701)
> at org.jboss.msc.service.ServiceControllerImpl$StartTask.execute(ServiceControllerImpl.java:1680)
> at org.jboss.msc.service.ServiceControllerImpl$ControllerTask.run(ServiceControllerImpl.java:1527)
> at org.jboss.threads.EnhancedQueueExecutor.safeRun(EnhancedQueueExecutor.java:1979)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.doRunTask(EnhancedQueueExecutor.java:1481)
> at org.jboss.threads.EnhancedQueueExecutor$ThreadBody.run(EnhancedQueueExecutor.java:1374)
> at java.lang.Thread.run(Thread.java:748)
> {code}
> Full SSL handshake log is in attached ssl_handshake_certificate.log
> So behaviour in these 2 cases is inconsistent. I think we have agreed before we let pass SSL handshake with expired certificate but warn about it in log [1].
> [1] https://issues.jboss.org/browse/JBEAP-6157
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months
[JBoss JIRA] (SWSQE-62) End to end test in parallel fashion - PoC
by Filip Brychta (JIRA)
Filip Brychta created SWSQE-62:
----------------------------------
Summary: End to end test in parallel fashion - PoC
Key: SWSQE-62
URL: https://issues.jboss.org/browse/SWSQE-62
Project: Swift Sunshine QE
Issue Type: Task
Reporter: Filip Brychta
Assignee: Filip Brychta
Working on prototype of scenario where we will run several UI test groups parallelly using jenkins slaves in OS on demand
--
This message was sent by Atlassian JIRA
(v7.5.0#75005)
8 years, 3 months