This is an automated email from the ASF dual-hosted git repository. jensg pushed a commit to branch 0.23.0 in repository https://gitbox.apache.org/repos/asf/thrift.git
commit 68ac8e935ef440c3e22d0e1a30e7211b9bf1d441 Author: Jens Geyer <[email protected]> AuthorDate: Tue Apr 14 19:00:00 2026 +0200 Enable TLS hostname verification in TNonblockingSSLSocket Client: java Set EndpointIdentificationAlgorithm to HTTPS on the SSLEngine parameters in the TNonblockingSSLSocket constructor so that the server certificate CN/SAN is validated against the target hostname during the TLS handshake. This mirrors the behavior of TSSLTransportFactory.createClient() and aligns the async SSL client with the sync client. Co-Authored-By: Claude Opus 4.6 <[email protected]> --- .../main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/lib/java/src/main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java b/lib/java/src/main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java index a6db23ee9..71204f69e 100644 --- a/lib/java/src/main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java +++ b/lib/java/src/main/java/org/apache/thrift/transport/TNonblockingSSLSocket.java @@ -30,6 +30,7 @@ import javax.net.ssl.SSLEngine; import javax.net.ssl.SSLEngineResult; import javax.net.ssl.SSLEngineResult.HandshakeStatus; import javax.net.ssl.SSLException; +import javax.net.ssl.SSLParameters; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -57,6 +58,9 @@ public class TNonblockingSSLSocket extends TNonblockingSocket implements SocketA super(host, port, timeout); sslEngine_ = sslContext.createSSLEngine(host, port); sslEngine_.setUseClientMode(true); + SSLParameters sslParams = sslEngine_.getSSLParameters(); + sslParams.setEndpointIdentificationAlgorithm("HTTPS"); + sslEngine_.setSSLParameters(sslParams); int appBufferSize = sslEngine_.getSession().getApplicationBufferSize(); int netBufferSize = sslEngine_.getSession().getPacketBufferSize();
