Java Ssl: How to Disable Hostname Verification

How to disable SSL hostname verification with Gatling and SSL two way

If someone is still looking for a solution: this feature has been implemented in v3.0 of Gatling.

The relevant configuration parameters are:

ahc {
    enableSni = true                                    # When set to true, enable Server Name indication (SNI)
    enableHostnameVerification = false                  # When set to true, enable hostname verification: SSLEngine.setHttpsEndpointIdentificationAlgorithm("HTTPS")
}

How to programmatically disable certificate hostname verification in Java LDAP JNDI LDAP API?

As @Patrick-Mevzek already stated: DON'T DO THIS!

But if you really must, here is how you would do it:

You need a SocketFactory that includes a dummy TrustManager that just ignores anything. There are many examples out there that show how to create such a thing. Unfortunatly most (all?) of them use a X509TrustManager for the job. This will work for invalid certificates but will not handle wrong or missing hostnames. For that you need a ```X509ExtendedTrustManager`:

import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.security.GeneralSecurityException;
import java.security.cert.X509Certificate;

import javax.net.SocketFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509ExtendedTrustManager;

/**
 * This Socket factory will accept all certificates and all hostnames
 */
public class NonVerifyingSSLSocketFactory extends SocketFactory {
   private static SocketFactory nonVerifyingSSLSochetFactory;

   static {
      TrustManager [] distrustManager = new TrustManager [] {new X509ExtendedTrustManager () {
         @Override
         public void checkClientTrusted (X509Certificate [] chain, String authType, Socket socket) {

         }

         @Override
         public void checkServerTrusted (X509Certificate [] chain, String authType, Socket socket) {

         }

         @Override
         public void checkClientTrusted (X509Certificate [] chain, String authType, SSLEngine engine) {

         }

         @Override
         public void checkServerTrusted (X509Certificate [] chain, String authType, SSLEngine engine) {

         }

         public X509Certificate [] getAcceptedIssuers () {
            return null;
         }

         public void checkClientTrusted (X509Certificate [] c, String a) {
         }

         public void checkServerTrusted (X509Certificate [] c, String a) {
         }
      }};

      try {
         SSLContext sc = SSLContext.getInstance ("SSL");
         sc.init (null, distrustManager, new java.security.SecureRandom ());
         nonVerifyingSSLSochetFactory = sc.getSocketFactory ();
      } catch (GeneralSecurityException e) {
         throw new RuntimeException (e);
      }
   }

   /**
    * This method is needed. It is called by the LDAP Context to create the connection
    *
    * @see SocketFactory#getDefault()
    */
   @SuppressWarnings ("unused")
   public static SocketFactory getDefault () {
      return new NonVerifyingSSLSocketFactory ();
   }

   /**
    * @see SocketFactory#createSocket(String, int)
    */
   public Socket createSocket (String arg0, int arg1) throws IOException {
      return nonVerifyingSSLSochetFactory.createSocket (arg0, arg1);
   }

   /**
    * @see SocketFactory#createSocket(java.net.InetAddress, int)
    */
   public Socket createSocket (InetAddress arg0, int arg1) throws IOException {
      return nonVerifyingSSLSochetFactory.createSocket (arg0, arg1);
   }

   /**
    * @see SocketFactory#createSocket(String, int, InetAddress, int)
    */
   public Socket createSocket (String arg0, int arg1, InetAddress arg2, int arg3) throws IOException {
      return nonVerifyingSSLSochetFactory.createSocket (arg0, arg1, arg2, arg3);
   }

   /**
    * @see SocketFactory#createSocket(InetAddress, int, InetAddress, int)
    */
   public Socket createSocket (InetAddress arg0, int arg1, InetAddress arg2,
                               int arg3) throws IOException {
      return nonVerifyingSSLSochetFactory.createSocket (arg0, arg1, arg2, arg3);
   }

}

Use that in your InitialLdapContext environment to activate it:

env.put ("java.naming.ldap.factory.socket", NonVerifyingSSLSocketFactory.class.getName ());

Tested with:

• openjdk version "1.8.0_191"
• oraclejdk version "1.8.0_25" (this version won't need it, but it works anyway and doesn't break anything)

How to disable hostname verification in spring webclient?

Aside from disabling SSL verification entirely, (WHICH I DON'T RECOMMEND) by passing in InsecureTrustManagerFactory.INSTANCE like this:

SslContext sslContext = SslContextBuilder.forClient()
                    .keyManager(kmf)
                    .trustManager(InsecureTrustManagerFactory.INSTANCE)
                    .build();

You can configure the HttpClient to essentially override the hostname verification by configuring a custom SNIMatcher as below:

HttpClient.create().create().secure(sslContextSpec -> sslContextSpec
    .sslContext(sslContext)
    .handlerConfigurator(sslHandler -> 
        SSLEngine engine = handler.engine();
        //engine.setNeedClientAuth(true);
        SSLParameters params = new SSLParameters();
        List<SNIMatcher> matchers = new LinkedList<>();

        SNIMatcher matcher = new SNIMatcher(0) {
            @Override
            public boolean matches(SNIServerName serverName) {
                return true;
            }
        };

        matchers.add(matcher);
        params.setSNIMatchers(matchers);
        engine.setSSLParameters(params);
);

I have tested this and verified it worked. I hope this helps!

This was inspired by the answer here: Configure HostnameVerifier with reactor netty for spring-webflux WebClient

How to disable Host name verification for nimbus JWKS ResourceRetriever

I resolved it by extending DefaultResourceRetriever and overriding openConnection(URL url) method.

If URL is HTTPS, it creates HttpsURLConnection. And we can set NoopHostnameVerifier to it.

Here is my solution :

public class NoopHostnameVerifyingResourceRetriever extends DefaultResourceRetriever {
    
      public NoopHostnameVerifyingResourceRetriever(int connectTimeout, int readTimeout) {
        super(connectTimeout, readTimeout);
      }
    
      @Override
      protected HttpURLConnection openConnection(URL url) throws IOException {
        HttpURLConnection connection = super.openConnection(url);
    
        if (connection instanceof HttpsURLConnection) {
          ((HttpsURLConnection) connection).setHostnameVerifier(new NoopHostnameVerifier());
        }
    
        return connection;
      }
}

Disable Host name verification in Solr SSL setup using self-signed certificate

I figure out way from their source code. Solr is checking for below property when creating HttpClient object. Default value is true if we set it to false then Solr wont check hostname in SSL.

-Dsolr.ssl.checkPeerName=false

Set this property into your wildfly startup script or whatever program you are running and it should work fine. Solr will no more verify hostname of URL with hostname of self-signed certificate.

Why is hostname verification done even though verifyHostname is false?

The JDK has handles LDAP separately and hostname verification is enabled by default by the JDK. To disable LDAP hostname verification you need to set the system property com.sun.jndi.ldap.object.disableEndpointIdentification to true. So in the jvm.options in your server directory add -Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true to disable hostname verification on an LDAP connention.

---

Related Topics