Question

6
Replies
1796
Views
LEPKB Member since 2009 2 posts
Pegasystems
Posted: 4 years ago
Last activity: 3 years 2 months ago
Closed

How to enable SNI (Server Name Indication) on SSL handshake?

Hi,

Does Pega7 Axis2 library supports SNI? We need to send a server name indication when we try to establish a secure connection with our customer server. Right now we don't send it so the server doesn’t know which certificate to return and connection is rejected.

Right now we need this setting for SOAP connections.

Best regards,

Bartek

Data Integration
Close popover
Moderation Team has archived post
Posted: 4 years ago

Hi Bartlomiej ,

I'm pretty sure that the SSL Handshake is done at the JVM SSL Iimplemenation layer; something that PRPC (or any Java Program for that matter) is not really aware of.

The reason I'm reasonably confident about this, is that the following standalone Java can demonstrate the SNI mechanism in play:

// System.setProperty("jsse.enableSNIExtension", "false");
URL url== new URL('https://<SNI-ENABLED-ENDPOINT>");
HttpsURLConnection conn= (HttpsURLConnection) url.openConnection();

Later version of the JVM (7.x - I can't remember the exact version: I think it is 1.7.0.67 - but check me on that) will default the JVM System Property 'jsee.enableSNIExtension' to 'true'; and this will result in an error if the endpoint doesn't support the SNI extension.

So for your case: where you say your endpoint already support 'SNI' - you probably want to re-test using the laster version of the JVM; or you might be able to set the property to 'true' on an earlier version.

Hope this helps,

John

Posted: 4 years ago

Hi John

Thank you for looking into the request, may you kindly confirm which config file in tomcat  will require an update

Also, is this needs to be set on the Java code, kindly apprise

Thanks and Regards

Ankur Kumar

Posted: 4 years ago

Hi Ankur,

I don't think this issue lies within the scope of PRPC configuration at all: it is handled at the JVM level and possibly (my understanding is a bit fuzzy here) the App Server itself.

Take a look at this third party link for instance: http://stackoverflow.com/questions/20190464/howto-setup-tomcat-serving-two-ssl-certificates-using-sni

It seems that SNI support is only available from Java 8 and Tomcat 9 according to that article.

Thanks,

John

Posted: 3 years ago

This is supported in PRPC 7.2.2 onward. 
Share this page LinkedIn
Copied!