KEMBAR78
Fix `allowInsecure()` on `HttpWaitStrategy` for non-localhost Docker daemon by kiview · Pull Request #6314 · testcontainers/testcontainers-java · GitHub
Skip to content

Conversation

@kiview
Copy link
Member

@kiview kiview commented Dec 20, 2022

We found out that HttpWaitStrategyTest.testWaitUntilReadyWithTlsAndAllowUnsecure() will fail with java.security.cert.CertificateException: No subject alternative names matching IP address 127.0.0.1 found when used with a Docker daemon that makes containers accessible on 127.0.0.1 rather than on localhost.

This seems to be due to our implementation of allowInsecure in HttpWaitStrategy, where we used a X509TrustManager, that only performs part of the certifacte validation.

This PR changes this implementation to now use a X509ExtendedTrustManager, to ignore this check accordingly. We don't consider this a security issue, since this is for the explicit use case, where a user wants the HttpWaitStrategy to ignore insecure SSL certificates.

@kiview kiview requested a review from a team December 20, 2022 17:00
@kiview kiview added this to the next milestone Dec 20, 2022
@eddumelendez eddumelendez merged commit 1abf0fa into main Dec 20, 2022
@eddumelendez eddumelendez deleted the http-wait-tls-insecure branch December 20, 2022 17:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants