AS7 Plugin - Secure Connections to Server

Stefan Negrea snegrea at redhat.com
Wed Aug 1 16:16:10 UTC 2012



----- Original Message -----
> From: "Lukas Krejci" <lkrejci at redhat.com>
> To: rhq-devel at lists.fedorahosted.org
> Sent: Wednesday, August 1, 2012 11:04:15 AM
> Subject: Re: AS7 Plugin - Secure Connections to Server
> 
> On Wednesday, August 01, 2012 11:36:23 Stefan Negrea wrote:
> 
> <snip>
> > For self-signed certificates, Firefox and
> > Chrome display a big red page with a big warning asking the user
> > whether to
> > proceed or not (and even give the option to permanently accept the
> > certificate). But by default JVM will just reject self-signed
> > certificates
> > unless the users does some JVM pre-configuration.
> 
> I believe John Sanda solved this on per connection basis in the
> Apache plugin:
> 
> http://git.fedorahosted.org/git?p=rhq/rhq.git;a=blob;f=modules/plugins/apache/src/main/java/org/rhq/plugins/www/util/WWWUtils.java;h=ab4cc571384c58c9b96cb4be788d7a9b76f811e7;hb=master#l229
> 
> Lukas


That implementation is exactly the fourth option from my proposal and the one that I would like to avoid as much as possible because it carries the most risk for the user.


"4) Provide an option in the plugin to allow users to accept self-signed certificates. Like the HTTPS option, this will be a boolean option to allow any certificate that defaults to false. The code above will need to change to use a temporary keystore created on demand to store these self-signed certificates at run-time. This approach is NOT recommended due to exposure to man-in-the-middle attacks."

> 
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 


More information about the rhq-devel mailing list