search

OxalisCommunity / oxalis

Oxalis - PEPPOL Access Point open source implementation - Core component
Other
129 stars 91 forks source link

Oxalis 4.0.2 inbound does not start when installed behind proxy #341

Closed PeterOlausson65 closed 6 years ago

PeterOlausson65 commented 6 years ago

I have a problem starting oxalis-inbound-4.0.2.war when placed on a private network behind a proxy. Even though I configure the proxy settings in oxalis.conf, the detection of certificate fails with a connection timeout. I have verified the proxy is working and the certificate I use works when I run on an installation with direct internet access (no proxy). Is there any way to configure the use of proxy for the certificate validation? There is a similar issue https://github.com/difi/oxalis/issues/335 with a provided workaround of removing the OCSP tag in the pki configuration files.

09:19:06.049 [10.164.31.8-startStop-1] INFO no.difi.vefa.peppol.security.ModeDetector - Detection error (TEST): connect timed out
09:19:06.073 [10.164.31.8-startStop-1] INFO no.difi.vefa.peppol.security.ModeDetector - Detection error (PRODUCTION): Validation of subject principal(CN) failed.
28-Aug-2018 09:19:06.080 SEVERE [10.164.31.8-startStop-1] org.apache.catalina.core.StandardContext.filterStart Exception starting filter
guiceFilter
com.google.inject.ProvisionException: Unable to provision, see the following errors:

1) Error in custom provider, no.difi.vefa.peppol.common.lang.PeppolLoadingException: Unable to detect mode for certificate 'C=FI, O=Tiet
o Finland Oy, OU=PEPPOL TEST AP, CN=PSE000025'.
  at no.difi.oxalis.commons.mode.ModeModule.providesMode(ModeModule.java:49)
  while locating no.difi.vefa.peppol.mode.Mode
    for the 3rd parameter of no.difi.oxalis.inbound.servlet.StatusServlet.<init>(StatusServlet.java:58)
  at no.difi.oxalis.inbound.servlet.StatusServlet.class(StatusServlet.java:58)
  while locating no.difi.oxalis.inbound.servlet.StatusServlet
PeterOlausson65 commented 6 years ago

Looking into the code I found out it uses net.klakegg.pkix.ocsp.fetcher.UrlOcspFetcher class, which uses the java.net.HttpURLConnection class. This can be configured with Java properties http.proxyHost and http.proxyPort. After adding those properties the OCSP works with proxy.