Option to configure SSL/TLS verification level

[Lucas3oo]

Feature Request

Need an option to only skip host name verification of the server certificate.
Typically when using AWS Redis the host name is a random name.
So we use a pre-defined DNS name for it instead but then the certificate by AWS will not match the hostname.

There is an option called "verifyPeer" but when that is set to false not only host name verification is skipped also all kinds of verification of certificates are skipped. So that option can't be use in production.

Describe the solution you'd like

A dedicated option to only skip host name verification just like standard SSL factory has.

Describe alternatives you've considered

Teachability, Documentation, Adoption, Migration Strategy

[mp911de]

What a few drivers provide is a SSL mode enum (like disabled, enabled, verify ca, verify full). On the other side, there are several ways how to verify a certificate (subject/SAN check, issuer trust relationship, validity period, fingerprinting). Especially fingerprint checking gains on popularity. I wonder whether we can combine these aspects somehow.

[mp911de]

Probably, there's a misconception. Java's HostnameVerifier runs after TrustManager has performed the SSL handshake and has validated certificates. Note that you can already configure a custom TrustManagerFactory.

What we can do here is introducing an SSL verification level as we're additionally configuring SSLParameters.setEndpointIdentificationAlgorithm("HTTPS") by default.

That intent could be expressed through RedisUri.setVerifyPeer(Verification.CERT) vs. RedisUri.setVerifyPeer(Verification.FULL) (corresponds with setVerifyPeer(true)).

[KowalczykBartek]

Is there any other option to implement this than providing custom X509ExtendedTrustManager to sslContextBuilder in SslConnectionBuilder ?

sslContextBuilder.trustManager(new TrustManagerFactory(new TrustManagerFactorySpi() {
    @Override
    protected void engineInit(KeyStore keyStore) {
        // NOOP
    }
    @Override
    protected TrustManager[] engineGetTrustManagers() {
        // Provide a custom trust manager, this manager trust all certificates
        return new TrustManager[] {
                new X509ExtendedTrustManager() {
                    @Override
                    public void checkClientTrusted(final X509Certificate[] chain, final String authType,
                            final Socket socket) throws CertificateException
                    {
                        // NOOP
                    }

                    @Override
                    public void checkServerTrusted(final X509Certificate[] chain, final String authType,
                            final Socket socket) throws CertificateException
                    {
                        // NOOP
                    }

                    @Override
                    public void checkClientTrusted(final X509Certificate[] chain, final String authType,
                            final SSLEngine engine) throws CertificateException
                    {
                        // NOOP
                    }

                    @Override
                    public void checkServerTrusted(final X509Certificate[] chain, final String authType,
                            final SSLEngine engine) throws CertificateException
                    {
                        // NOOP
                    }

                    @Override
                    public void checkClientTrusted(
                            java.security.cert.X509Certificate[] x509Certificates, String s) {
                        // NOOP
                    }

                    @Override
                    public void checkServerTrusted(
                            java.security.cert.X509Certificate[] x509Certificates, String s) {
                        // NOOP
                    }

                    @Override
                    public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                        return EmptyArrays.EMPTY_X509_CERTIFICATES;
                    }
                }
        };
    }

    @Override
    protected void engineInit(ManagerFactoryParameters managerFactoryParameters) {
    }
}, null, TrustManagerFactory.getDefaultAlgorithm()) {
});

[mp911de]

That's in place now via RedisURI.setVerifyPeer(CA).

[shikharkhanna]

can TLS 1.2 be configured now using Lettuce??

[mp911de]

Yes, via SslOptions.sslParameters(…).

[shikharkhanna]

cool thanks

[vikasmav]

setVerifyPeer

If we are using Spring Data Redis with Lettuce Client then how can we set this flag. Currently I do not see any provision to set this up who are using spring data redis