akka-http Http.outgoingConnectionHttps and self-signed certs

[Eric Swenson]

I have a need (no, not in production) to have an akka-based service contact another service using TLS where the remote service is using a self-signed cert.

I've used AkkaSSLConfig to configure the "loose" settings:

val looseConfig = SSLLooseConfig().withAcceptAnyCertificate(true).
  withDisableHostnameVerification(true).
  withAllowLegacyHelloMessages(Some(true)).
  withAllowUnsafeRenegotiation(Some(true)).
  withAllowWeakCiphers(true).
  withAllowWeakProtocols(true).
  withDisableSNI(true)

and despite trying all of the, still get the following exception when trying to access the remote service:

     sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

It was my impression that the loose config:

    withAcceptAnyCertificate(true)

should have prevented the TLS implementation from trying to verify the cert. 

What am I missing?  What the the correct way to accept self-signed certs using akka-http's Http() client?

-- Eric

[Konrad Malawski]

Have you attempted to "do the right thing" ™?

Which is to add the certificate to a trust store, instead of disabling all TLS features?

It's actually not that hard and documented here: http://typesafehub.github.io/ssl-config/CertificateGeneration.html

Also, you can always drop down to the raw low level Java APIs, as this example shows: 

https://github.com/akka/akka/blob/master/akka-http-tests/src/main/java/akka/http/javadsl/server/examples/simple/SimpleServerApp.java

(it's server side, but the same process can be done for client – pretty much)

-- 
Konrad `ktoso` Malawski
Akka @ Lightbend

--
>>>>>>>>>> Read the docs: http://akka.io/docs/
>>>>>>>>>> Check the FAQ: http://doc.akka.io/docs/akka/current/additional/faq.html
>>>>>>>>>> Search the archives: https://groups.google.com/group/akka-user
---
You received this message because you are subscribed to the Google Groups "Akka User List" group.
To unsubscribe from this group and stop receiving emails from it, send an email to akka-user+...@googlegroups.com.
To post to this group, send email to akka...@googlegroups.com.
Visit this group at https://groups.google.com/group/akka-user.
For more options, visit https://groups.google.com/d/optout.

[Eric Swenson]

I don't want or need to configure a specific trust anchor. I want to be able to do the equivalent of "curl -k" on a set of local servers, with different signing certs. I would have thought the loose "acceptAnyCertificate" would have been precisely for this.  What does that setting do?

If the only way to allow self-signed certs is through setting up a trust store, I can do that.

-- Eric

[Eric Swenson]

Apart from my prior point — that it is not practical for my test environment to configure all the trust anchors (self signed cert signer), I decided to try it anyhow for a single self-signed cert. I still am having issues: here is the code:

val trustStoreConfig = TrustStoreConfig(None, Some("/Users/eswenson/self-signed-cert.jks"))

  val trustManagerConfig = TrustManagerConfig().withTrustStoreConfigs(List(trustStoreConfig))

  val looseConfig = SSLLooseConfig().withAcceptAnyCertificate(true).

    withDisableHostnameVerification(true).

    withAllowLegacyHelloMessages(Some(true)).

    withAllowUnsafeRenegotiation(Some(true)).

    withAllowWeakCiphers(true).

    withAllowWeakProtocols(true).

    withDisableSNI(true)

  val sslConfig = AkkaSSLConfig().mapSettings(s =>

     s.withLoose(looseConfig).withTrustManagerConfig(trustManagerConfig)

  )

  val connectionContext = Http().createClientHttpsContext(sslConfig)

  lazy val connectionFlow: Flow[HttpRequest, HttpResponse, Any] =

    Http().outgoingConnectionHttps(host, port, connectionContext)

  def httpSRequest(request: HttpRequest): Future[HttpResponse] =

    Source.single(request).via(connectionFlow).runWith(Sink.head)

As you can see, I’m using a trust store with the self-signed cert in it.  Even with the trust store and enabling all the loose config options (I tried it without looseConfig to no avail), I’m still getting errors:

background log: info: [INFO] [05/17/2016 18:49:17.574] [ClusterSystem-akka.actor.default-dispatcher-25] [ExperimentInstance(akka://ClusterSystem)] fetchExperiment: exception=akka.stream.ConnectionException: Hostname verification failed! Expected session to be for xxx-GfsElb-1RLMB4EAK0HUM-785838730.us-west-2.elb.amazonaws.com

background log: error: akka.stream.ConnectionException: Hostname verification failed! Expected session to be for xxx-GfsElElb-1RLMB4EAK0HUM-785838730.us-west-2.elb.amazonaws.com

Why is it doing any host name verification?  The loose config specifies:

     withDisableHostnameVerification(true)

I’m finding it hard to believe it is this hard to do HTTPS with self-signed certs.  Any suggestions?

— Eric

[Joan G]

What happened at the end?

I'm having the same issue and find insane that disabling all the security (just to identify where is the issue) is still not working.

[Eric Swenson]

Hi Joan,

To be honest, I haven’t looked at this stuff in ages.  We set up our own PKI CA and switched to using non-self-signed certs.  However, before we did this, I had gotten things working with self-signed certs.  Unfortunately, I don’t have that code in active usage anywhere now.  I did find the following commented-out code in one version of a service.   Not sure if it works and even compiles with the latest Akka.  But here it is in its ugly entirety:

/*

  // temporary code because we're using self-signed certs

  val classLoader: ClassLoader = Thread.currentThread().getContextClassLoader

  val jksInputStream = classLoader.getResourceAsStream(“dev.jks")

  val jksTempFilePathname = Files.createTempFile("jksTemp", "jks").toString

  val jksOutputStream = new FileOutputStream(jksTempFilePathname)

  try {

    IOUtils.copy(jksInputStream, jksOutputStream)

  } finally {

    jksInputStream.close

  }

  val trustStoreConfig = TrustStoreConfig(None, Some(jksTempFilePathname))

  val trustManagerConfig = TrustManagerConfig().withTrustStoreConfigs(List(trustStoreConfig))

  val looseConfig = SSLLooseConfig().withDisableHostnameVerification(true)

  val sslConfig = AkkaSSLConfig().mapSettings { s =>

    s.withLoose(looseConfig).withTrustManagerConfig(trustManagerConfig)

  }

*/

You received this message because you are subscribed to a topic in the Google Groups "Akka User List" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/akka-user/DjCQP28l52k/unsubscribe.
To unsubscribe from this group and all its topics, send an email to akka-user+...@googlegroups.com.