Would like to get SSLSession from WebSocket on server to examine client certificates

[doyledavidson]

I am using "TLS Client Certificates" when connecting to my WSS server. Everything works great with my own TrustManager supplied via a SSLContext set to require client authentication.

However i can find no formal mechanism to access the SSLSession from the WebSocket/WebSocketImpl. The WebSocketImpl has a channel which is implemented by the SSLSocketChannel that has an SSLEngine which has a getSession() method. Could you please add methods to expose the SSLSession from which I can get the peer certificates.

Obviously this is valid only for TLS connections.

Thanks for consideration!

Doyle

[marci4]

Hello @doyledavidson,

could you do me the favor and provide an repository with these client certificates working so I can figure out a good way on how to implement your request?

Thank you very much!

Best regards,
Marcel

[doyledavidson]

Attached (I hope this works) is a zip with:
Working client and server source code with TLS support classes. Cert and trust key stores (.pkcf12 files) and a Windows batch file to recreate it it needed.
The client and server use the same key store for simplicity of demo.

I will be on vacation for the next week starting tomorrow, so please understand if I don't reply for a while.

Doyle
nate_client_cert.zip.zip

[doyledavidson]

To be clear, if you put a break point in the onOpen() method in SimpleServer.java, I want to get to:
(WebSocket)conn->(SSLSocketChannel) channel->(SSLEngine)sslEngine->sess (SSLSession).

So something like a method on WebSocket interface:
SSLSession getSSLSession(); // may return null if not using TLS

Thanks again for consideration!

Doyle

[marci4]

Hello @doyledavidson,

thank you very much for your example.

Please check out #893 with my proposed solution!

Best regards,
Marcel

[doyledavidson]

That looks good! I would just change the IllegalArgumentException to IllegalStateException in the getSSLSession() impl.

Thanks for looking into this!

[marci4]

@doyledavidson thank you for taking a look at my proposal. Changed it to IllegalStateException