[DIRMINA-1122] Add support for endpoint identification algorithm

• Type: Improvement
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.22, 2.1.3
• Fix Version/s: 2.1.7, 2.0.24, 2.2.2
• Component/s: Filter, SSL
• Assignee: Jonathan Valliere
• Reporter: Marcin L
• Created: 15/Apr/20 08:53
• Updated: 01/Jun/23 22:47
• Resolved: 01/Jun/23 22:47

Description

Support for endpoint identification algorithm was added in Java 1.7. Currently MINA supports providing single SNI name via org.apache.mina.filter.ssl.SslFilter#PEER_ADDRESS session attribute, but there is no way verifying it matches the certificate received.

It would be nice if we could provide endpoint identification algorithm to SslFilter so certificate's common name or subject alternative names are verified.

Issue Links

• is part of: DIRMINA-1132 TLSv1.3 - MINA randomly fails in reading the message sent by client
• is related to: DIRSTUDIO-1255 ApacheDS Does Not Send TLS HostSNI Extension Information in Requests