Description

viretp

opened on Jan 17, 2025

Issue body actions

Version used: 1.0.20

We need the HttpsExchange.getSSLSession() method to get the SSLSession from the exchange in order to be able to check the client certificate used in the SSL Handshake.
Unfortunately, when using the robaho httpserver, the result of this method seems to be always null, even when https is used and the client has sent a certificate in the handshake. With the jdk httpserver this works fine.

Thanks in advance for any help.

Here our code, which works fine with jdk httpserver:

            try {
                getLogger().log(Level.FINE, "get TLS client certificate, if any");
                SSLSession sslSession = exchange.getSSLSession();
                if (sslSession == null) {
                    getLogger().log(Level.FINE, "No SSLSession in exchange");
                } else {
                    Certificate[] certs = sslSession.getPeerCertificates();
                    if (certs[0] instanceof X509Certificate x509Cert) {
                        exchangeInfos.setTlsClientCert(x509Cert);
                        exchangeInfos.setTlsClientVerified(true);
                        getLogger().log(Level.FINEST, "Client certificate: {0}", x509Cert);
                    } else {
                        getLogger().log(Level.SEVERE, "Not a X509Certificate: {0}", certs[0].getClass().getName());
                    }
                }
            } catch (SSLPeerUnverifiedException e) {
                if (commonConfig.isSSLDebugOn()) {
                    getLogger().log(Level.FINEST, "No client certificate", e);
                } else {
                    getLogger().log(Level.FINE, "No client certificate");
                }
            }

Activity

1. robaho commented on Jan 17, 2025

   

   robaho

   on Jan 17, 2025

   Owner

   More actions

   Is this with http or http2?
2. viretp commented on Jan 17, 2025

   

   viretp

   on Jan 17, 2025

   ContributorAuthor

   More actions

   This is with http/1.1
   I will check the behavior with http2.
3. viretp commented on Jan 17, 2025

   

   viretp

   on Jan 17, 2025

   ContributorAuthor

   More actions

   I can confirm the same behavior with http/2: the SSLSession returned by HttpsExchange.getSSLSession() is null there, too .
4. robaho commented on Jan 17, 2025

   

   robaho

   on Jan 17, 2025

   Owner

   More actions

   I will look into it today. This is one of the warts with the JDK api - the getSession should have been defined for HttpExchange and just have it return null - instead you need to cast to HttpsExchange to make the call.

   This is why I asked if using http2 - because currently all exchanges are implemented as HttpsExchanges.
5. robaho

   added 2 commits that reference this issue on Jan 17, 2025

   test case for issue #16 unable to get SSL session from exchange

   8355144

   test case for issue #16 unable to get SSL session from exchange

   701d5b1
6. robaho commented on Jan 17, 2025

   

   robaho

   on Jan 17, 2025

   Owner

   More actions

   I have been able to reproduce. Working on a fix.
7. robaho

   added a commit that references this issue on Jan 17, 2025

   fix issue #16 Unable to get client certificate because HttpsExchange.…

   74f1a4a
8. robaho commented on Jan 17, 2025

   

   robaho

   on Jan 17, 2025

   Owner

   More actions

   This is fixed in version 1.0.21 which is being pushed to maven now. Thanks for reporting this.
9. robaho

   closed this as completedon Jan 17, 2025
10. viretp commented on Jan 20, 2025

    

    viretp

    on Jan 20, 2025

    ContributorAuthor

    More actions

    Thanks a lot. I have integrated the new version 1.0.21 and the problem is now solved.

Issue actions