Disable certifcate validation for service provider client
@@ -3,6 +3,9 @@ package com.yahoo.container.jdisc.athenz.impl;
import org.apache.http.client.methods.CloseableHttpResponse;
import org.apache.http.client.methods.RequestBuilder;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.conn.ssl.SSLContextBuilder;
+import org.apache.http.conn.ssl.TrustSelfSignedStrategy;
import org.apache.http.impl.client.CloseableHttpClient;
import org.apache.http.impl.client.HttpClientBuilder;
import org.apache.http.util.EntityUtils;
@@ -10,6 +13,9 @@ import org.eclipse.jetty.http.HttpStatus;
import java.io.IOException;
import java.net.URI;
+import java.security.KeyManagementException;
+import java.security.KeyStoreException;
+import java.security.NoSuchAlgorithmException;
/**
* @author mortent
@@ -26,10 +32,7 @@ public class ServiceProviderApi {
* Get signed identity document from config server
*/
public String getSignedIdentityDocument() {
-
- // TODO Use client side auth to establish trusted secure channel
- try (CloseableHttpClient httpClient = HttpClientBuilder.create().build()) {
-
+ try (CloseableHttpClient httpClient = createHttpClient()) {
CloseableHttpResponse idDocResponse = httpClient.execute(RequestBuilder.get().setUri(providerUri + "/identity-document").build());
if (HttpStatus.isSuccess(idDocResponse.getStatusLine().getStatusCode())) {
return EntityUtils.toString(idDocResponse.getEntity());
@@ -42,4 +45,19 @@ public class ServiceProviderApi {
}
}
+ // TODO Use client side auth to establish trusted secure channel
+ // TODO Validate TLS certifcate of config server
+ private static CloseableHttpClient createHttpClient() {
+ try {
+ SSLContextBuilder sslContextBuilder = new SSLContextBuilder();
+ sslContextBuilder.loadTrustMaterial(null, new TrustSelfSignedStrategy());
+ SSLConnectionSocketFactory sslSocketFactory =
+ new SSLConnectionSocketFactory(sslContextBuilder.build(),
+ SSLConnectionSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
+ return HttpClientBuilder.create().setSSLSocketFactory(sslSocketFactory).build();
+ } catch (KeyManagementException | NoSuchAlgorithmException | KeyStoreException e) {
+ throw new RuntimeException(e);
+ }
+ }
+
}
