AS7 Plugin - Secure Connections to Server

Lukas Krejci lkrejci at redhat.com
Wed Aug 1 16:21:13 UTC 2012


On Wednesday, August 01, 2012 12:16:10 Stefan Negrea wrote:
> ----- Original Message -----
> 
> > From: "Lukas Krejci" <lkrejci at redhat.com>
> > To: rhq-devel at lists.fedorahosted.org
> > Sent: Wednesday, August 1, 2012 11:04:15 AM
> > Subject: Re: AS7 Plugin - Secure Connections to Server
> > 
> > On Wednesday, August 01, 2012 11:36:23 Stefan Negrea wrote:
> > 
> > <snip>
> > 
> > > For self-signed certificates, Firefox and
> > > Chrome display a big red page with a big warning asking the user
> > > whether to
> > > proceed or not (and even give the option to permanently accept the
> > > certificate). But by default JVM will just reject self-signed
> > > certificates
> > > unless the users does some JVM pre-configuration.
> > 
> > I believe John Sanda solved this on per connection basis in the
> > Apache plugin:
> > 
> > http://git.fedorahosted.org/git?p=rhq/rhq.git;a=blob;f=modules/plugins/apa
> > che/src/main/java/org/rhq/plugins/www/util/WWWUtils.java;h=ab4cc571384c58c
> > 9b96cb4be788d7a9b76f811e7;hb=master#l229
> > 
> > Lukas
> 
> That implementation is exactly the fourth option from my proposal and the
> one that I would like to avoid as much as possible because it carries the
> most risk for the user.
> 

Yes, I was more referring to the fact that you claimed this required some JVM 
preconfiguration.

I agree it is the least safe option in AS7. We use it in Apache, because the 
HTTPS URLs are only ever used for pinging the server to determine 
availability, no other info is fetched from or delivered to that location.

> 
> "4) Provide an option in the plugin to allow users to accept self-signed
> certificates. Like the HTTPS option, this will be a boolean option to allow
> any certificate that defaults to false. The code above will need to change
> to use a temporary keystore created on demand to store these self-signed
> certificates at run-time. This approach is NOT recommended due to exposure
> to man-in-the-middle attacks."
> > _______________________________________________
> > rhq-devel mailing list
> > rhq-devel at lists.fedorahosted.org
> > https://lists.fedorahosted.org/mailman/listinfo/rhq-devel
> 
> _______________________________________________
> rhq-devel mailing list
> rhq-devel at lists.fedorahosted.org
> https://lists.fedorahosted.org/mailman/listinfo/rhq-devel


More information about the rhq-devel mailing list