Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve the discrepancy between the default value of SSL trustDefaultCerts #632

Open
leochr opened this issue Aug 16, 2024 · 1 comment
Open
Assignees

Comments

@leochr
Copy link
Member

leochr commented Aug 16, 2024

The default value of trustDefaultCerts of SSL seems to be different between the full images of OL and WL and would provide different default behaviour for trusting certificates.

OL full image's server.xml (only used by JDK 21): https://github.com/OpenLiberty/ci.docker/blob/main/releases/latest/full/server.xml
WL full image's server.xml: https://github.com/WASdev/ci.docker/blob/main/ga/latest/full/server.xml

Other relevant files that influence the default value of trustDefaultCerts:

OL:
https://github.com/OpenLiberty/ci.docker/blob/62d9f7b2ff1c3b0f36e8c1cb1b0be2d482abed36/releases/latest/full/helpers/runtime/docker-server.sh#L81
https://github.com/OpenLiberty/ci.docker/blob/main/releases/latest/full/helpers/build/configuration_snippets/trustDefault.xml

WL:

elif [ ! -z $SEC_TLS_TRUSTDEFAULTCERTS ]; then

https://github.com/WASdev/ci.docker/blob/main/ga/latest/kernel/helpers/build/configuration_snippets/trustDefault.xml

@kabicin kabicin self-assigned this Sep 12, 2024
@kabicin
Copy link
Collaborator

kabicin commented Oct 17, 2024

@leochr I validated that the default behaviour for both full OL and WL images is to trust default certs and there is no discrepancy.

Instead there is a warning message on OL stemming from the server.xml because of line <ssl id="defaultSSLConfig" trustDefaultCerts="true" /> which is seen as a double-declaration from config already applied in docker-server.sh leading to this message:

Property trustDefaultCerts has conflicting values:
Value true is set in file:/opt/ol/wlp/usr/servers/defaultServer/server.xml.
Value ${SEC_TLS_TRUSTDEFAULTCERTS} is set in file:/opt/ol/wlp/usr/servers/defaultServer/configDropins/overrides/truststore.xml.
Property trustDefaultCerts will be set to ${SEC_TLS_TRUSTDEFAULTCERTS}.

This indicates that the trustDefaultCerts will be set to SEC_TLS_TRUSTDEFAULTCERTS which upon inspection is also set to true and in line with what the Java 21 OL server.xml is setting.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

2 participants