OxalisCommunity / oxalis

Oxalis - PEPPOL Access Point open source implementation - Core component
Other
129 stars 91 forks source link

Sending to an AP with invalid server certificate gives no error #283

Closed PeterOlausson65 closed 6 years ago

PeterOlausson65 commented 7 years ago

Validating towards "AS2 Access Point Services Acceptance Test Plan version 2.0.0" There is a requirement: "The Access Point identifies if the other Access Point does not sign the response messages (MDN) with a valid certificate issued by PEPPOL for use in the transport infrastructure"

I test this with Oxalis 4.0.0 RC1 outbound AS2 towards an Oxalis server being configured with a self-signed certificate (not authorized by PEPPOL). The Oxalis outbound client is setup for PRODUCTION mode. The message gets uploaded without error. The only indication of the bad server is a warning message in log4j "WARN [eu.peppol.outbound.transmission.As2MessageSender] Exception when verifying MDN signature : Common name in certificate from SMP does not match common name in AP certificate "

Should there not be a send exception instead of the warning?

klakegg commented 6 years ago

Fixed in Oxalis 4.0 RC2.