Repository navigation
Unable to get client certificate because HttpsExchange.getSSLSession() returns null #16
Description
Version used: 1.0.20
We need the HttpsExchange.getSSLSession() method to get the SSLSession from the exchange in order to be able to check the client certificate used in the SSL Handshake.
Unfortunately, when using the robaho httpserver, the result of this method seems to be always null, even when https is used and the client has sent a certificate in the handshake. With the jdk httpserver this works fine.
Thanks in advance for any help.
Here our code, which works fine with jdk httpserver:
try {
getLogger().log(Level.FINE, "get TLS client certificate, if any");
SSLSession sslSession = exchange.getSSLSession();
if (sslSession == null) {
getLogger().log(Level.FINE, "No SSLSession in exchange");
} else {
Certificate[] certs = sslSession.getPeerCertificates();
if (certs[0] instanceof X509Certificate x509Cert) {
exchangeInfos.setTlsClientCert(x509Cert);
exchangeInfos.setTlsClientVerified(true);
getLogger().log(Level.FINEST, "Client certificate: {0}", x509Cert);
} else {
getLogger().log(Level.SEVERE, "Not a X509Certificate: {0}", certs[0].getClass().getName());
}
}
} catch (SSLPeerUnverifiedException e) {
if (commonConfig.isSSLDebugOn()) {
getLogger().log(Level.FINEST, "No client certificate", e);
} else {
getLogger().log(Level.FINE, "No client certificate");
}
}
Activity
robaho commentedon Jan 17, 2025
Is this with http or http2?
viretp commentedon Jan 17, 2025
This is with http/1.1
I will check the behavior with http2.
viretp commentedon Jan 17, 2025
I can confirm the same behavior with http/2: the SSLSession returned by HttpsExchange.getSSLSession() is null there, too .
robaho commentedon Jan 17, 2025
I will look into it today. This is one of the warts with the JDK api - the getSession should have been defined for HttpExchange and just have it return null - instead you need to cast to HttpsExchange to make the call.
This is why I asked if using http2 - because currently all exchanges are implemented as HttpsExchanges.
test case for issue #16 unable to get SSL session from exchange
test case for issue #16 unable to get SSL session from exchange
robaho commentedon Jan 17, 2025
I have been able to reproduce. Working on a fix.
fix issue #16 Unable to get client certificate because HttpsExchange.…
robaho commentedon Jan 17, 2025
This is fixed in version 1.0.21 which is being pushed to maven now. Thanks for reporting this.
viretp commentedon Jan 20, 2025
Thanks a lot. I have integrated the new version 1.0.21 and the problem is now solved.