[WAGON-383] Regression for SSLv3

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.2, 2.3
• Fix Version/s: 2.4
• Component/s: wagon-http
• Environment: Operation system independent, but tested on Macbook Pro with 10.6 and Red Hat Enterprise Linux 6 on a virtual machine.
• Assignee: Olivier Lamy
• Reporter: James Kionka
• Created: 25/Oct/12 16:11
• Updated: 05/Feb/13 03:08
• Resolved: 05/Feb/13 03:08

Description

When attempting to access a Maven repository which uses SSLv3, you get the following error, "javax.net.ssl.SSLException: Received fatal alert: bad_record_mac".

Earlier versions of Maven used java.net.URLConnection which respects the https.protocols system property. This allowed us to set it to SSLv3, which is what our Maven repository uses. However, HttpClient ignores that property. In other situations, we programmatically tell HttpClient to use SSLv3, which we cannot do from our end.

You can find another person in the same situation here: http://stackoverflow.com/questions/12787657/received-fatal-alert-bad-record-mac-when-deploying-to-sonatype

Issue Links

• depends upon: WAGON-372 SSL client-side certificates stopped working in maven 3.0.4
• is related to: MNG-5175 replace wagon http lightweight with wagon http 2.1