From 2f9951128864607d97b1122d2588df8306d8955d Mon Sep 17 00:00:00 2001 From: Aayush Atharva Date: Fri, 17 Jul 2026 20:02:52 +0000 Subject: [PATCH] Enable HTTPS endpoint identification in JsseSslEngineFactory A JDK SSLEngine does not verify the peer hostname unless the endpoint identification algorithm is set, so JsseSslEngineFactory accepted a certificate valid for any host. DefaultSslEngineFactory already enables it. Set it here too, honoring disableHttpsEndpointIdentificationAlgorithm, so a custom JDK SSLContext no longer silently loses hostname verification. --- .../asynchttpclient/netty/ssl/JsseSslEngineFactory.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/client/src/main/java/org/asynchttpclient/netty/ssl/JsseSslEngineFactory.java b/client/src/main/java/org/asynchttpclient/netty/ssl/JsseSslEngineFactory.java index 1c76eb84ed..dee7f59be7 100644 --- a/client/src/main/java/org/asynchttpclient/netty/ssl/JsseSslEngineFactory.java +++ b/client/src/main/java/org/asynchttpclient/netty/ssl/JsseSslEngineFactory.java @@ -19,6 +19,7 @@ import javax.net.ssl.SSLContext; import javax.net.ssl.SSLEngine; +import javax.net.ssl.SSLParameters; public class JsseSslEngineFactory extends SslEngineFactoryBase { @@ -31,6 +32,14 @@ public JsseSslEngineFactory(SSLContext sslContext) { @Override public SSLEngine newSslEngine(AsyncHttpClientConfig config, String peerHost, int peerPort) { SSLEngine sslEngine = sslContext.createSSLEngine(domain(peerHost), peerPort); + // A JDK SSLEngine does not verify the peer hostname unless the endpoint identification algorithm + // is set, so without this a certificate valid for any host would be accepted. Enable it to match + // DefaultSslEngineFactory, honoring disableHttpsEndpointIdentificationAlgorithm. + if (!config.isDisableHttpsEndpointIdentificationAlgorithm()) { + SSLParameters params = sslEngine.getSSLParameters(); + params.setEndpointIdentificationAlgorithm("HTTPS"); + sslEngine.setSSLParameters(params); + } configureSslEngine(sslEngine, config); return sslEngine; }