[GEODE-9139] SSLException in starting up a Locator

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 1.15.0
• Component/s: membership, messaging
• Labels: pull-request-available
• Assignee: Kamilla Aslami
• Reporter: Bruce J Schuchardt
• Created: 12/Apr/21 17:32
• Updated: 22/Jun/22 20:46
• Resolved: 09/Sep/21 18:55

Description

If you start up a locator using its host name, without a domain name, as a bind address you may get an SSLException in the form

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching hostname.domainname found

The LocatorLauncher and InternalLocator throw away the bind address string and later do a reverse lookup to find the fully qualified hostname to use in endpoint identification matching. If the locator's own TLS certificate doesn't have the fully qualified name in it as a Subject Alternate Name the connection that the Locator makes to its own location service will fail.

Issue Links

• causes: GEODE-10015 gfsh does not send hostname in SNI header
• fixes: GEODE-8655 Not handling exception on SNIHostName
• relates to: GEODE-8144 endpoint identification in servers is not working
• relates to: GEODE-9396 Upgrades using SSL fail with mismatch of hostname in certificates
• links to: GitHub Pull Request #6308
• links to: GitHub Pull Request #6401
• links to: GitHub Pull Request #6436
• links to: GitHub Pull Request #6619
• links to: GitHub Pull Request #6635
• links to: GitHub Pull Request #6636
• links to: GitHub Pull Request #6681
• links to: GitHub Pull Request #6690