How to enable SNI (Server Name Indication) on SSL handshake?
Hi,
Does Pega7 Axis2 library supports SNI? We need to send a server name indication when we try to establish a secure connection with our customer server. Right now we don't send it so the server doesn’t know which certificate to return and connection is rejected.
Right now we need this setting for SOAP connections.
Best regards,
Bartek
PEG
IN
Hi Bartek,
Can you please review following SA on PDN?
https://pdn.pega.com/support-articles/sni-validation-issues-sslprotocolexception
Hope this helps you in configuring SNI
Pegasystems Inc.
GB
Hi Bartlomiej ,
I'm pretty sure that the SSL Handshake is done at the JVM SSL Iimplemenation layer; something that PRPC (or any Java Program for that matter) is not really aware of.
The reason I'm reasonably confident about this, is that the following standalone Java can demonstrate the SNI mechanism in play:
// System.setProperty("jsse.enableSNIExtension", "false");
URL url== new URL('https://<SNI-ENABLED-ENDPOINT>");
HttpsURLConnection conn= (HttpsURLConnection) url.openConnection();
Later version of the JVM (7.x - I can't remember the exact version: I think it is 1.7.0.67 - but check me on that) will default the JVM System Property 'jsee.enableSNIExtension' to 'true'; and this will result in an error if the endpoint doesn't support the SNI extension.
So for your case: where you say your endpoint already support 'SNI' - you probably want to re-test using the laster version of the JVM; or you might be able to set the property to 'true' on an earlier version.
Hope this helps,
John
Pegasystems Inc.
GB
Hi John
Thank you for looking into the request, may you kindly confirm which config file in tomcat will require an update
Also, is this needs to be set on the Java code, kindly apprise
Thanks and Regards
Ankur Kumar
Pegasystems Inc.
GB
Hi Ankur,
I don't think this issue lies within the scope of PRPC configuration at all: it is handled at the JVM level and possibly (my understanding is a bit fuzzy here) the App Server itself.
Take a look at this third party link for instance: http://stackoverflow.com/questions/20190464/howto-setup-tomcat-serving-two-ssl-certificates-using-sni
It seems that SNI support is only available from Java 8 and Tomcat 9 according to that article.
Thanks,
John
PEG
GB
I presume your SOAP connection is over HTTP.
Please check your JVM version used support SNI.
For instance, Oracle/Sun JVM should send the SNI from version 7. Look at article below which indirectly tells it:
Bug ID: JDK-7127374 JSSE creates SSLProtocolException on (common) warning: unrecognized_name for SNI
In SUN jvm version 7, this is turned on by default unless it is turned off by using the following setting:
-Djsse.enableSNIExtension=false
Macquarie Group
AU
This is supported in PRPC 7.2.2 onward.