SSL context factory class should be changed to comply with recent versions of Jetty

Question

SSL context factory class should be changed to comply with recent versions of Jetty

erdinckocaman opened this issue 4 years ago · comments

Jetty changed ssl implementation classes a little so this module with last versions of Jetty gives such an error when ssl used;

java.lang.IllegalStateException: KeyStores with multiple certificates are not supported on the base class org.eclipse.jetty.util.ssl.SslContextFactory. (Use org.eclipse.jetty.util.ssl.SslContextFactory$Server or org.eclipse.jetty.util.ssl.SslContextFactory$Client instead)

I think class "https://github.com/bootique/bootique-jetty/blob/master/bootique-jetty/src/main/java/io/bootique/jetty/connector/HttpsConnectorFactory.java" should use "org.eclipse.jetty.util.ssl.SslContextFactory$Server" instead of plain" SslContextFactory".

Andrus Adamchik · Answer 1 · Fri Jul 03 2020 18:57:31 GMT+0800 (China Standard Time)

Good catch. SslContextFactory constructor is in fact deprecated. I just made this change on 2.0 and 1.2 branches. How do I create a certificate I can test it with though?

erdinckocaman · Answer 2 · Sun Jul 05 2020 22:32:12 GMT+0800 (China Standard Time)

Any self signed certificate should suffice.

Andrus Adamchik · Answer 3 · Thu Jul 09 2020 19:04:47 GMT+0800 (China Standard Time)

We already had those in the unit tests, and they worked without the change. So maybe that was the wrong question. IIRC the error happens in SNI scenarios. Was wondering how to emulate them in tests. Though not super important I suppose. We are not trying to second-guess Jetty after all.

erdinckocaman · Answer 4 · Mon Jul 13 2020 03:10:03 GMT+0800 (China Standard Time)

I don't think it is about SNI scenarios. It always gives such an error message. It is easy to see errors since upgrading to last version of Jetty is enough for reproducing the case.