getting SSLHandshakeException exception while calling api through the route locator

Question

I am using below code to route to the particular service and all services are running on https but while calling these api through the locator but getting SSLHandshakeException.

@Bean
    public RouteLocator customRouteLocator(RouteLocatorBuilder builder,
                                           TokenRelayGatewayFilterFactory filterFactory) {
        return builder.routes()
                .route(p -> p.path("/abc/api/**")
                        .filters(f -> f.filter(filterFactory.apply()))`enter code here`
                        .uri("https://localhost:8081"))
                .route(p -> p.path("/bcd/api/**")
                        .filters(f -> f.filter(filterFactory.apply()))
                        .uri("https://localhost:8082/"))
                .build();
    }

2021-08-12 10:54:45.611 ERROR 1060 --- [ctor-http-nio-4] a.w.r.e.AbstractErrorWebExceptionHandler : [100eea72-1]  500 Server Error for HTTP GET "/abc/api/preference/country-list"

javax.net.ssl.SSLHandshakeException: No name matching localhost found
    at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131) ~[na:na]
    Suppressed: reactor.core.publisher.FluxOnAssembly$OnAssemblyException: 
Error has been observed at the following site(s):
    |_ checkpoint ⇢ org.springframework.cloud.gateway.filter.WeightCalculatorWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.authorization.AuthorizationWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.authorization.ExceptionTranslationWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.authentication.logout.LogoutWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.savedrequest.ServerRequestCacheWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.context.SecurityContextServerWebExchangeWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.ui.LogoutPageGeneratingWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.ui.LoginPageGeneratingWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$BearerTokenAuthenticationWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.oauth2.client.web.server.authentication.OAuth2LoginAuthenticationWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.oauth2.client.web.server.OAuth2AuthorizationRequestRedirectWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.context.ReactorContextWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.web.cors.reactive.CorsWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.header.HttpHeaderWriterWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.config.web.server.ServerHttpSecurity$ServerWebExchangeReactorContextWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.security.web.server.WebFilterChainProxy [DefaultWebFilterChain]
    |_ checkpoint ⇢ org.springframework.boot.actuate.metrics.web.reactive.server.MetricsWebFilter [DefaultWebFilterChain]
    |_ checkpoint ⇢ HTTP GET "/abc/api/preference/country-list" [ExceptionHandlingWebHandler]

user_4925383 · Answer

This error message means that during TLS handshake the server responded with a certificate which Subject / Subject Alternative Names didn't include localhost. First thing is to check what does the server certificate contain:

openssl s_client -connect localhost:

Save everything starting with -----BEGIN CERTIFICATE----- and ending with -----END CERTIFICATE----- as cert.pem and inspect with:

openssl x509 -in cert.pem -text -noout

This should show you both Subject and Subject Alternative Names, if any.

You have at least a few options here:

Configure server with a certificate which has localhost in SAN.
Disable hostname verification, either by VM param (if your underlying library supports this) or through code.
Override default DNS resolution and redirect the traffic to whatever is in the server certificate Subject or SAN to localhost. This can be done through hosts file or custom DNS resolver. Custom resolver requires more work and will depend on the underlying library that you use.

getting SSLHandshakeException exception while calling api through the route locator

1 Answers