[NIFI-3788] Support wildcard certificates in Amazon S3 Processors

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.1.1
• Fix Version/s: 1.2.0
• Component/s: Core Framework
• Labels: certificate pki security tls
• Assignee: Andy LoPresto
• Reporter: Andy LoPresto
• Created: 03/May/17 17:29
• Updated: 04/May/17 16:19
• Resolved: 04/May/17 16:12

Description

Some users have reported issues when attempting to connect to an external service which is secured for TLS via a wildcard certificate (i.e. hostname is https://example.domain.com and the certificate DN contains CN=*.domain.com when using the Amazon Web Services (AWS S3) processors. This requires changes in the SSLStandardContextService to correctly parse the CN and evaluate wildcard entries if present This required changes in the DefaultHostnameVerifier instance being passed to the SdkTLSSocketFactory and AmazonHTTPClientConfig in AbstractAWSProcessor.

In addition, as specified by RFC 2818, certificate evaluation (specifically hostname validation) should prioritize Subject Alternative Names over DN parsing. Chrome 58+ has begun to implement this prioritization, which can cause issues with certificate validation even if the CN matches the hostname but SANs are present but do not include the hostname.

Issue Links

• links to: GitHub Pull Request #1753