{"action":"created","issue":{"url":"https://api.github.com/repos/quickfix-j/quickfixj/issues/49","labels_url":"https://api.github.com/repos/quickfix-j/quickfixj/issues/49/labels{/name}","comments_url":"https://api.github.com/repos/quickfix-j/quickfixj/issues/49/comments","events_url":"https://api.github.com/repos/quickfix-j/quickfixj/issues/49/events","html_url":"https://github.com/quickfix-j/quickfixj/pull/49","id":121342286,"number":49,"title":"QFJ-821 - acceptor/initiator certificate authentication","user":{"login":"the-thing","id":3160158,"avatar_url":"https://avatars.githubusercontent.com/u/3160158?v=3","gravatar_id":"","url":"https://api.github.com/users/the-thing","html_url":"https://github.com/the-thing","followers_url":"https://api.github.com/users/the-thing/followers","following_url":"https://api.github.com/users/the-thing/following{/other_user}","gists_url":"https://api.github.com/users/the-thing/gists{/gist_id}","starred_url":"https://api.github.com/users/the-thing/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/the-thing/subscriptions","organizations_url":"https://api.github.com/users/the-thing/orgs","repos_url":"https://api.github.com/users/the-thing/repos","events_url":"https://api.github.com/users/the-thing/events{/privacy}","received_events_url":"https://api.github.com/users/the-thing/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":9,"created_at":"2015-12-09T21:27:04Z","updated_at":"2015-12-22T19:26:00Z","closed_at":"2015-12-18T23:57:46Z","pull_request":{"url":"https://api.github.com/repos/quickfix-j/quickfixj/pulls/49","html_url":"https://github.com/quickfix-j/quickfixj/pull/49","diff_url":"https://github.com/quickfix-j/quickfixj/pull/49.diff","patch_url":"https://github.com/quickfix-j/quickfixj/pull/49.patch"},"body":"Implemented acceptor/initiator certificate authentication.\r\n\r\n- new SSL properties:\r\nKeyManagerFactoryAlgorithm (default X509)\r\nKeyStoreType (default JKS)\r\nSocketTrustStore\r\nSocketTrustStorePassword\r\nTrustManagerFactoryAlgorithm (default PKIX)\r\nTrustStoreType (default JKS)\r\nNeedClientAuth (default N)\r\nEnabledProtocols (default - Java supported protocols)\r\nCipherSuites (default - Java default cipher suites)\r\n\r\n- removed quickifx.mina.ssl.SimpleTrustManagerFactory class as there is no need for it, MINA provides org.apache.mina.filter.ssl.BogusTrustManagerFactory which\r\nserves the same purpose\r\n\r\n- added quickfix.mina.ssl.SSLFilter class which fixes issues with MINA overriding cipher suites to Java enabled cipher suites\r\n\r\n- comprehensive tests under quickfix.mina.ssl.SSLCertificateTest\r\n\r\n- QFJ-838 and QFJ-854 had to be fix along the way as I encountered the same problems"},"comment":{"url":"https://api.github.com/repos/quickfix-j/quickfixj/issues/comments/166708921","html_url":"https://github.com/quickfix-j/quickfixj/pull/49#issuecomment-166708921","issue_url":"https://api.github.com/repos/quickfix-j/quickfixj/issues/49","id":166708921,"user":{"login":"the-thing","id":3160158,"avatar_url":"https://avatars.githubusercontent.com/u/3160158?v=3","gravatar_id":"","url":"https://api.github.com/users/the-thing","html_url":"https://github.com/the-thing","followers_url":"https://api.github.com/users/the-thing/followers","following_url":"https://api.github.com/users/the-thing/following{/other_user}","gists_url":"https://api.github.com/users/the-thing/gists{/gist_id}","starred_url":"https://api.github.com/users/the-thing/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/the-thing/subscriptions","organizations_url":"https://api.github.com/users/the-thing/orgs","repos_url":"https://api.github.com/users/the-thing/repos","events_url":"https://api.github.com/users/the-thing/events{/privacy}","received_events_url":"https://api.github.com/users/the-thing/received_events","type":"User","site_admin":false},"created_at":"2015-12-22T19:26:00Z","updated_at":"2015-12-22T19:26:00Z","body":"The problem is when using empty truststore file with **sun.security.ssl.X509TrustManagerImpl**. **checkClientTrusted** and **checkServerTrusted** methods raise java.lang.RuntimeException instead of java.security.cert.CertificateException which is expected by sun.security.ssl.ClientHandshaker/ServerHandshaker to fail SSL handshake immediately. \r\n\r\n```\r\njava.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty\r\n\tat sun.security.validator.PKIXValidator.<init>(Unknown Source)\r\n\tat sun.security.validator.Validator.getInstance(Unknown Source)\r\n\tat sun.security.ssl.X509TrustManagerImpl.getValidator(Unknown Source)\r\n\tat sun.security.ssl.X509TrustManagerImpl.checkTrustedInit(Unknown Source)\r\n\tat sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)\r\n\tat sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)\r\n\tat quickfix.mina.ssl.TrustManagerProxy.checkServerTrusted(TrustManagerProxy.java:47)\r\n\tat sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source)\r\n\tat sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)\r\n\tat sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)\r\n```\t\r\n\r\nWe could:\r\n\r\n1) Increase exception latch timeout for these type of tests to make sure there is enough time to generate an exception on disconnect. Not very nice and QuickFix tests already take a long time.\r\n\r\n2) Create X509TrustManager interface delegate which re-throws RuntimeException as CertificateException. Tests could be made a lot faster, but we are coupled with X509TrustManager. On the other hand this is the only algorithm standard JVM supports.\r\n \r\n3) Get rid of SSLException assertions completely since logon and certificate checks do their thing.\r\n\r\nPersonally I would go with option 2. Any suggestions?"}}