TLS certificate failing to connect (but the same cert works fine with MLCP)

[mlzarathustra]

This exact same cert and password work just fine for both MLCP and a custom java app I wrote (xq-java) but it fails with "handshake_failure" when I try with CORB.

Here is the command line (with passwords &c. redacted) including a debug flag that generates a ton of output. Without that flag, CORB doesn't report the actual problem (the handshake failure) until after the 3rd try.

java -cp /.../marklogic-corb-2.5.4.jar:/.../marklogic-xcc-11.0.0.jar: \ -DXCC-PROTOCOL=xccs -DXCC-HOSTNAME=hostname -DXCC-PORT=8888 \ -DXCC-USERNAME=user -DXCC-PASSWORD="" -DXCC-URL-ENCODE-COMPONENTS=always \ -DMETRICS-LOG-LEVEL=debug -DTHREAD-COUNT=3 \ -DURIS-MODULE=/.../uris.xqy'|ADHOC' -DPROCESS-MODULE=/.../process.xqy'|ADHOC' \ -DSSL-KEYSTORE=/usr/home/cert.jks -DSSL-KEYSTORE-PASSWORD= \ -DSSL-KEYSTORE-TYPE=JKS -DSSL-ENABLED-PROTOCOLS=TLSv1.2 -Djavax.net.debug=all \ com.marklogic.developer.corb.Manager

[mlzarathustra]

OK, there IS a workaround, but it is ugly.

I have to say: -DSSL-CONFIG-CLASS=com.marklogic.developer.corb.TwoWaySSLConfig

Which is anything but obvious.

Thing is, if I'm specifying a keystore, it will never work unless I'm using this class, instead of the default "trust anyone" class which does not pass KeyManagers to sslConfig.init(). So if I'm giving the application a keystore and a password for it, it should AUTOMATICALLY pick the correct class instead of stalling out with a mysterious message.

[hansenmc]

I agree, that it would be more convenient if CoRB automatically applied the TwoWaySSLConfig class if options specific to that implementation are applied to the job (and the user has not explicitly set SSL-CONFIG-CLASS).

Similar to https://github.com/marklogic-community/corb2/issues/130 we can look to make configuration easier, and not have to explicitly set every single option.

[mlzarathustra]

I have a simple patch for this that I'll send along once the company whose network it's on decides it's OK for me to upload it, which hopefully they will. It was automatically blocked for containing source code. It's just a simple check whether the keystore file is defined, and if so, it selects the "TwoWay" class. Which incidentally is NOT two-way, as it does not check the server certificate.

IMO that part of the application is way over-engineered, but I am not sure it's worth refactoring because of the need for testing.

[mlzarathustra]

Here is the patch I'm using:

diff --git a/build.gradle b/build.gradle
index 7970b8a..eec69c3 100644
--- a/build.gradle
+++ b/build.gradle
@@ -96,6 +96,10 @@ dependencies {
     testImplementation 'org.jasypt:jasypt:1.9.3'
     testImplementation 'com.github.stefanbirkner:system-rules:1.19.0' //facilitates tests for methods that invoke System.exit
     testImplementation 'org.mockito:mockito-all:1.10.19'
+    //
+    implementation 'javax.xml.bind:jaxb-api:2.3.1'
+    implementation 'com.sun.xml.bind:jaxb-core:2.3.0.1'
+    implementation 'com.sun.xml.bind:jaxb-impl:2.3.7'
 }

 test {
diff --git a/src/main/java/com/marklogic/developer/corb/AbstractManager.java b/src/main/java/com/marklogic/developer/corb/AbstractManager.java
index 49b83e8..f178099 100644
--- a/src/main/java/com/marklogic/developer/corb/AbstractManager.java
+++ b/src/main/java/com/marklogic/developer/corb/AbstractManager.java
@@ -28,6 +28,7 @@ import static com.marklogic.developer.corb.Options.XCC_PASSWORD;
 import static com.marklogic.developer.corb.Options.XCC_PORT;
 import static com.marklogic.developer.corb.Options.XCC_USERNAME;
 import static com.marklogic.developer.corb.Options.XCC_PROTOCOL;
+import static com.marklogic.developer.corb.Options.SSL_KEYSTORE;
 import static com.marklogic.developer.corb.util.IOUtils.isDirectory;

 import com.marklogic.developer.corb.util.NumberUtils;
@@ -264,8 +265,15 @@ public abstract class AbstractManager {
                 throw new CorbException(MessageFormat.format("Unable to instantiate {0} {1}", SSL_CONFIG_CLASS, sslConfigClassName), ex);
             }
         } else {
-            LOG.log(INFO, () -> "Using TrustAnyoneSSSLConfig because no " + SSL_CONFIG_CLASS + " value specified.");
-            sslConfig = new TrustAnyoneSSLConfig();
+            String sslKeystore = getOption(SSL_KEYSTORE);
+            if (sslKeystore != null) {
+                LOG.log(INFO, () -> "SSL_KEYSTORE is defined (as "+sslKeystore+"); using TwoWaySSLConfig.");
+                sslConfig = new TwoWaySSLConfig();
+            }
+            else {
+                LOG.log(INFO, () -> "Using TrustAnyoneSSSLConfig because no " + SSL_CONFIG_CLASS + " value specified.");
+                sslConfig = new TrustAnyoneSSLConfig();
+            }
         }
         sslConfig.setProperties(properties);
         sslConfig.setDecrypter(decrypter);