Akka http SSLConfig problems with hostname verification and certificate verification

Question

I have some problems with the Akka http client-side configuration. I am trying to connect to a server that does not provide: - a publicly signed certificate - a certificate that matches the host name I do not have a hand on this nginx, so I can not change the configuration on the server side. I can only change the client side.

After much research on configuring SSL, I found that I need to configure SSL settings in application.conf at two different levels:

akka.ssl-config.ssl.loose.acceptAnyCertificate=true akka.ssl-config.loose.disableHostnameVerification = true 

and

 ssl-config.loose.acceptAnyCertificate=true ssl-config.loose.disableHostnameVerification = true 

I checked the configuration ok with

 log-config-on-start = "on" 

The problem is that I still get the error at the aka debug level (not very clear)

 [ingestionApiClient-akka.actor.default-dispatcher-13] [akka://ingestionApiClient/user/StreamSupervisor-0/flow-216-1-unknown-operation] closing output 

Looking at wirehark, I found that the certificate verification problem

 TLSv1 Record Layer: Alert (Level: Fatal, Description: Certificate Unknown) 

I believe that the JVM configuration overrides everything I did, so I also tried using this method to change the JVM SSL configuration: Java SSL: how to disable host name verification

There is no problem setting up SSLContext and passing it to akka http, because I can set the default HttpsContext with

 val sc = SSLContext.getInstance("TLS") *...configuration...* val customContext =HttpsContext(sc, sslParameters = Some(params)) Http().setDefaultClientHttpsContext(customHttpsContext) 

But I still can't configure the default name verifier. The Http class does not have a method like Http().setDefaultHostnameVerifier

This is how I connect to the server

 val dataIngestFlow = Http().outgoingConnectionTls(config.httpEndpointHost,config.httpEndpointPort) 

How can i achieve this? Many thanks for your help.

Answer 1

I don’t know which version of akka and akka-http you are using, but have you tried setting the akka.ssl-config.hostnameVerifierClass configuration field for your specific implementation of the HostNameVerifier interface?

The simplest verifier that accepts everything is as follows:

 public static class AcceptAllHostNameVerifier implements HostnameVerifier { @Override public boolean verify(String s, SSLSession sslSession) { return true; } } 

Answer 2

I was also stuck in a similar problem and was getting similar errors . with the following code, I was able to get through:

 val trustStoreConfig = TrustStoreConfig(None, Some("/etc/Project/keystore/my.cer")).withStoreType("PEM") val trustManagerConfig = TrustManagerConfig().withTrustStoreConfigs(List(trustStoreConfig)) val badSslConfig = AkkaSSLConfig().mapSettings(s => s.withLoose(s.loose .withAcceptAnyCertificate(true) .withDisableHostnameVerification(true) ).withTrustManagerConfig(trustManagerConfig)) val badCtx = Http().createClientHttpsContext(badSslConfig) Http().superPool[RequestTracker](badCtx)(httpMat)