diff --git a/jetty-server/src/test/java/org/eclipse/jetty/server/ssl/SniSslConnectionFactoryTest.java b/jetty-server/src/test/java/org/eclipse/jetty/server/ssl/SniSslConnectionFactoryTest.java index 9b78f593977f..91954a40065a 100644 --- a/jetty-server/src/test/java/org/eclipse/jetty/server/ssl/SniSslConnectionFactoryTest.java +++ b/jetty-server/src/test/java/org/eclipse/jetty/server/ssl/SniSslConnectionFactoryTest.java @@ -40,6 +40,7 @@ import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; +import org.eclipse.jetty.http.HttpStatus; import org.eclipse.jetty.http.HttpTester; import org.eclipse.jetty.http.HttpVersion; import org.eclipse.jetty.io.Connection; @@ -489,6 +490,21 @@ protected void customize(Socket socket, Class connection, assertEquals(0, history.size()); } + @Test + public void testSNIWithDifferentKeyTypes() throws Exception + { + // This KeyStore contains 2 certificates, one with keyAlg=EC, one with keyAlg=RSA. + start(ssl -> ssl.setKeyStorePath("src/test/resources/keystore_sni_key_types.p12")); + + // Make a request with SNI = rsa.domain.com, the RSA certificate should be chosen. + HttpTester.Response response1 = HttpTester.parseResponse(getResponse("rsa.domain.com", "rsa.domain.com")); + assertEquals(HttpStatus.OK_200, response1.getStatus()); + + // Make a request with SNI = ec.domain.com, the EC certificate should be chosen. + HttpTester.Response response2 = HttpTester.parseResponse(getResponse("ec.domain.com", "ec.domain.com")); + assertEquals(HttpStatus.OK_200, response2.getStatus()); + } + private String getResponse(String host, String cn) throws Exception { String response = getResponse(host, host, cn); diff --git a/jetty-server/src/test/resources/keystore_sni_key_types.p12 b/jetty-server/src/test/resources/keystore_sni_key_types.p12 new file mode 100644 index 000000000000..b000fbeff573 Binary files /dev/null and b/jetty-server/src/test/resources/keystore_sni_key_types.p12 differ diff --git a/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SniX509ExtendedKeyManager.java b/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SniX509ExtendedKeyManager.java index db05a0f6afcd..2c55cdec1f8a 100644 --- a/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SniX509ExtendedKeyManager.java +++ b/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SniX509ExtendedKeyManager.java @@ -250,7 +250,7 @@ public interface SniSelector *

Selects a certificate based on SNI information.

*

This method may be invoked multiple times during the TLS handshake, with different parameters. * For example, the {@code keyType} could be different, and subsequently the collection of certificates - * (because they need to match the {@code keyType}.

+ * (because they need to match the {@code keyType}).

* * @param keyType the key algorithm type name * @param issuers the list of acceptable CA issuer subject names or null if it does not matter which issuers are used diff --git a/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SslContextFactory.java b/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SslContextFactory.java index 1104dbd19df3..a445cad47903 100644 --- a/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SslContextFactory.java +++ b/jetty-util/src/main/java/org/eclipse/jetty/util/ssl/SslContextFactory.java @@ -2155,12 +2155,17 @@ public void setWantClientAuth(boolean wantClientAuth) } /** - * Does the default {@link #sniSelect(String, Principal[], SSLSession, String, Collection)} implementation - * require an SNI match? Note that if a non SNI handshake is accepted, requests may still be rejected - * at the HTTP level for incorrect SNI (see SecureRequestCustomizer). + *

Returns whether an SNI match is required when choosing the alias that + * identifies the certificate to send to the client.

+ *

The exact logic to choose an alias given the SNI is configurable via + * {@link #setSNISelector(SniX509ExtendedKeyManager.SniSelector)}.

+ *

The default implementation is {@link #sniSelect(String, Principal[], SSLSession, String, Collection)} + * and if SNI is not required it will delegate the TLS implementation to + * choose an alias (typically the first alias in the KeyStore).

+ *

Note that if a non SNI handshake is accepted, requests may still be rejected + * at the HTTP level for incorrect SNI (see SecureRequestCustomizer).

* - * @return true if no SNI match is handled as no certificate match, false if no SNI match is handled by - * delegation to the non SNI matching methods. + * @return whether an SNI match is required when choosing the alias that identifies the certificate */ @ManagedAttribute("Whether the TLS handshake is rejected if there is no SNI host match") public boolean isSniRequired() @@ -2169,14 +2174,12 @@ public boolean isSniRequired() } /** - * Set if the default {@link #sniSelect(String, Principal[], SSLSession, String, Collection)} implementation - * require an SNI match? Note that if a non SNI handshake is accepted, requests may still be rejected - * at the HTTP level for incorrect SNI (see SecureRequestCustomizer). - * This setting may have no effect if {@link #sniSelect(String, Principal[], SSLSession, String, Collection)} is - * overridden or a non null function is passed to {@link #setSNISelector(SniX509ExtendedKeyManager.SniSelector)}. + *

Sets whether an SNI match is required when choosing the alias that + * identifies the certificate to send to the client.

+ *

This setting may have no effect if {@link #sniSelect(String, Principal[], SSLSession, String, Collection)} is + * overridden or a custom function is passed to {@link #setSNISelector(SniX509ExtendedKeyManager.SniSelector)}.

* - * @param sniRequired true if no SNI match is handled as no certificate match, false if no SNI match is handled by - * delegation to the non SNI matching methods. + * @param sniRequired whether an SNI match is required when choosing the alias that identifies the certificate */ public void setSniRequired(boolean sniRequired) { @@ -2244,9 +2247,15 @@ public String sniSelect(String keyType, Principal[] issuers, SSLSession session, .filter(x509 -> x509.matches(sniHost)) .collect(Collectors.toList()); - // No match, let the JDK decide unless unmatched SNIs are rejected. if (matching.isEmpty()) - return isSniRequired() ? null : SniX509ExtendedKeyManager.SniSelector.DELEGATE; + { + // There is no match for this SNI among the certificates valid for + // this keyType; check if there is any certificate that matches this + // SNI, as we will likely be called again with a different keyType. + boolean anyMatching = aliasCerts().values().stream() + .anyMatch(x509 -> x509.matches(sniHost)); + return isSniRequired() || anyMatching ? null : SniX509ExtendedKeyManager.SniSelector.DELEGATE; + } String alias = matching.get(0).getAlias(); if (matching.size() == 1)