Skip to content

Conversation

@olivergondza
Copy link
Member

The SSL cert verification is not performed by default, and needs to be turned on by system property - which is obscuring the need to do so at all.

This change flips the default without changing any functionality. When the flag is not provided, it verifies the cert unless -Dsplunkins.verifySSL=false is provided.

This was verified manually to actually trust self-signed certs before, while it rejects them afterwards.

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • [n/a] Link to relevant issues in GitHub or Jira
  • [n/a] Link to relevant pull requests, esp. upstream and downstream changes
  • [n/a] Ensure you have provided tests - that demonstrates feature works or fixes the issue

@olivergondza
Copy link
Member Author

@fengxx, please take a look! Thanks!

@fengxx
Copy link

fengxx commented Mar 13, 2023

thanks, but toggle default SSL verification will cause problems

  1. all existing users who are using self cert are affected
  2. splunk default uses SplunkServerDefaultCert for CN name, which will not pass TLS hostname verification
  3. new plugin install doesn't work out of box, users have to edit Jenkins startup arguments
    I created allow user config CA and tls #33 instead

@fengxx fengxx closed this Mar 13, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants