From a309f35296f22eb824645e383bd34d1a063447b4 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:19:15 +1000 Subject: [PATCH 01/19] feat(config): make outbound TLS hostname checks configurable SECURITY: enable hostname verification by default --- .../dto/rest/config/network/SslConfigDTO.java | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/src/main/java/io/mapsmessaging/dto/rest/config/network/SslConfigDTO.java b/src/main/java/io/mapsmessaging/dto/rest/config/network/SslConfigDTO.java index c4e57764c..d78d1a5c5 100644 --- a/src/main/java/io/mapsmessaging/dto/rest/config/network/SslConfigDTO.java +++ b/src/main/java/io/mapsmessaging/dto/rest/config/network/SslConfigDTO.java @@ -50,6 +50,15 @@ public class SslConfigDTO extends BaseConfigDTO { ) protected boolean clientCertificateWanted = false; + @Schema( + description = "Whether outbound TLS connections verify the server certificate hostname.", + example = "true", + defaultValue = "true", + requiredMode = Schema.RequiredMode.REQUIRED, + nullable = false + ) + protected boolean hostnameVerificationEnabled = true; + @Schema( description = "URL for the Certificate Revocation List (CRL). " + "If not set, CRL checking is disabled.", From f85807f9179da3b04a5ae2873bb9d71a9dadc0b2 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:19:43 +1000 Subject: [PATCH 02/19] fix(config): resolve TLS and DTLS security profiles correctly SECURITY: preserve SSL settings across load and update --- .../config/network/SslConfig.java | 100 +++++++++++------- 1 file changed, 60 insertions(+), 40 deletions(-) diff --git a/src/main/java/io/mapsmessaging/config/network/SslConfig.java b/src/main/java/io/mapsmessaging/config/network/SslConfig.java index e0cd845ee..a9ef0e3c8 100644 --- a/src/main/java/io/mapsmessaging/config/network/SslConfig.java +++ b/src/main/java/io/mapsmessaging/config/network/SslConfig.java @@ -23,77 +23,97 @@ import io.mapsmessaging.configuration.ConfigurationProperties; import io.mapsmessaging.dto.rest.config.BaseConfigDTO; import io.mapsmessaging.dto.rest.config.network.SslConfigDTO; +import java.util.Objects; import lombok.EqualsAndHashCode; import lombok.ToString; @EqualsAndHashCode(callSuper = true) @ToString -public class SslConfig extends SslConfigDTO implements Config { +public class SslConfig extends SslConfigDTO implements Config { public SslConfig(ConfigurationProperties config) { - ConfigurationProperties securityProps = locateConfig(config); - this.context = securityProps.getProperty("context", "tls"); - this.clientCertificateRequired = config.getBooleanProperty("clientCertificateRequired", false); - this.clientCertificateWanted = config.getBooleanProperty("clientCertificateWanted", false); - this.crlUrl = config.getProperty("crlUrl", null); - this.crlInterval = config.getLongProperty("crlInterval", 0); + this(config, "tls"); + } + + public SslConfig(ConfigurationProperties config, String transport) { + ConfigurationProperties securityProps = locateConfig(config, transport); + if (securityProps == null) { + throw new IllegalArgumentException("Missing security." + transport + " configuration"); + } + String defaultContext = "dtls".equalsIgnoreCase(transport) ? "DTLSv1.2" : "TLSv1.3"; + this.context = securityProps.getProperty("context", defaultContext); + this.clientCertificateRequired = securityProps.getBooleanProperty("clientCertificateRequired", false); + this.clientCertificateWanted = securityProps.getBooleanProperty("clientCertificateWanted", false); + this.hostnameVerificationEnabled = securityProps.getBooleanProperty("hostnameVerificationEnabled", true); + this.crlUrl = securityProps.getProperty("crlUrl", null); + this.crlInterval = securityProps.getLongProperty("crlInterval", 3600000L); this.keyStore = new KeyStoreConfig((ConfigurationProperties) securityProps.get("keyStore")); this.trustStore = new KeyStoreConfig((ConfigurationProperties) securityProps.get("trustStore")); } - private ConfigurationProperties locateConfig(ConfigurationProperties config) { - if (config.containsKey("clientCertificateRequired")) { + private ConfigurationProperties locateConfig(ConfigurationProperties config, String transport) { + if (config.containsKey("keyStore") || config.containsKey("trustStore") || config.containsKey("clientCertificateRequired")) { return config; } - ConfigurationProperties security = (ConfigurationProperties) config.get("security"); - if (security != null) { - security = (ConfigurationProperties) security.get("tls"); - } ConfigurationProperties endPoint = (ConfigurationProperties) config.get("endPoint"); if (endPoint != null) { - return locateConfig(endPoint); + ConfigurationProperties endPointSecurity = locateConfig(endPoint, transport); + if (endPointSecurity != null) { + return endPointSecurity; + } } - return security; + ConfigurationProperties security = (ConfigurationProperties) config.get("security"); + return security == null ? null : (ConfigurationProperties) security.get(transport); } public boolean update(BaseConfigDTO config) { - boolean hasChanged = false; - if (config instanceof SslConfigDTO) { - SslConfigDTO newConfig = (SslConfigDTO) config; + if (!(config instanceof SslConfigDTO newConfig)) { + return false; + } - if (this.clientCertificateRequired != newConfig.isClientCertificateRequired()) { - this.clientCertificateRequired = newConfig.isClientCertificateRequired(); - hasChanged = true; - } - if (this.clientCertificateWanted != newConfig.isClientCertificateWanted()) { - this.clientCertificateWanted = newConfig.isClientCertificateWanted(); - hasChanged = true; - } - if (!this.crlUrl.equals(newConfig.getCrlUrl())) { - this.crlUrl = newConfig.getCrlUrl(); - hasChanged = true; - } - if (this.crlInterval != newConfig.getCrlInterval()) { - this.crlInterval = newConfig.getCrlInterval(); - hasChanged = true; - } - if (((KeyStoreConfig)this.keyStore).update(newConfig.getKeyStore())) { - hasChanged = true; - } - if (((KeyStoreConfig)this.trustStore).update(newConfig.getTrustStore())) { - hasChanged = true; - } + boolean hasChanged = false; + if (this.clientCertificateRequired != newConfig.isClientCertificateRequired()) { + this.clientCertificateRequired = newConfig.isClientCertificateRequired(); + hasChanged = true; + } + if (this.clientCertificateWanted != newConfig.isClientCertificateWanted()) { + this.clientCertificateWanted = newConfig.isClientCertificateWanted(); + hasChanged = true; + } + if (this.hostnameVerificationEnabled != newConfig.isHostnameVerificationEnabled()) { + this.hostnameVerificationEnabled = newConfig.isHostnameVerificationEnabled(); + hasChanged = true; + } + if (!Objects.equals(this.context, newConfig.getContext())) { + this.context = newConfig.getContext(); + hasChanged = true; + } + if (!Objects.equals(this.crlUrl, newConfig.getCrlUrl())) { + this.crlUrl = newConfig.getCrlUrl(); + hasChanged = true; + } + if (this.crlInterval != newConfig.getCrlInterval()) { + this.crlInterval = newConfig.getCrlInterval(); + hasChanged = true; + } + if (newConfig.getKeyStore() != null && ((KeyStoreConfig) this.keyStore).update(newConfig.getKeyStore())) { + hasChanged = true; + } + if (newConfig.getTrustStore() != null && ((KeyStoreConfig) this.trustStore).update(newConfig.getTrustStore())) { + hasChanged = true; } return hasChanged; } public ConfigurationProperties toConfigurationProperties() { ConfigurationProperties config = new ConfigurationProperties(); + config.put("context", this.context); config.put("clientCertificateRequired", this.clientCertificateRequired); config.put("clientCertificateWanted", this.clientCertificateWanted); + config.put("hostnameVerificationEnabled", this.hostnameVerificationEnabled); config.put("crlUrl", this.crlUrl); config.put("crlInterval", this.crlInterval); config.put("keyStore", ((KeyStoreConfig) keyStore).toConfigurationProperties()); From c43f5de781291079e845c4e1c5c4ff34738b72e9 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:19:56 +1000 Subject: [PATCH 03/19] fix(config): make key-store updates null safe NO-ISSUE --- .../config/network/KeyStoreConfig.java | 15 ++++++++------- 1 file changed, 8 insertions(+), 7 deletions(-) diff --git a/src/main/java/io/mapsmessaging/config/network/KeyStoreConfig.java b/src/main/java/io/mapsmessaging/config/network/KeyStoreConfig.java index cca242e63..187bd2057 100644 --- a/src/main/java/io/mapsmessaging/config/network/KeyStoreConfig.java +++ b/src/main/java/io/mapsmessaging/config/network/KeyStoreConfig.java @@ -23,6 +23,7 @@ import io.mapsmessaging.configuration.ConfigurationProperties; import io.mapsmessaging.dto.rest.config.BaseConfigDTO; import io.mapsmessaging.dto.rest.config.network.KeyStoreConfigDTO; +import java.util.Objects; import lombok.EqualsAndHashCode; import lombok.ToString; @@ -45,31 +46,31 @@ public boolean update(BaseConfigDTO config) { boolean hasChanged = false; if (config instanceof KeyStoreConfigDTO) { KeyStoreConfigDTO newConfig = (KeyStoreConfigDTO) config; - if (!this.alias.equals(newConfig.getAlias())) { + if (!Objects.equals(this.alias, newConfig.getAlias())) { this.alias = newConfig.getAlias(); hasChanged = true; } - if (!this.type.equals(newConfig.getType())) { + if (!Objects.equals(this.type, newConfig.getType())) { this.type = newConfig.getType(); hasChanged = true; } - if (!this.providerName.equals(newConfig.getProviderName())) { + if (!Objects.equals(this.providerName, newConfig.getProviderName())) { this.providerName = newConfig.getProviderName(); hasChanged = true; } - if (!this.managerFactory.equals(newConfig.getManagerFactory())) { + if (!Objects.equals(this.managerFactory, newConfig.getManagerFactory())) { this.managerFactory = newConfig.getManagerFactory(); hasChanged = true; } - if (!this.path.equals(newConfig.getPath())) { + if (!Objects.equals(this.path, newConfig.getPath())) { this.path = newConfig.getPath(); hasChanged = true; } - if (!this.passphrase.equals(newConfig.getPassphrase())) { + if (!Objects.equals(this.passphrase, newConfig.getPassphrase())) { this.passphrase = newConfig.getPassphrase(); hasChanged = true; } - if (!this.provider.equals(newConfig.getProvider())) { + if (!Objects.equals(this.provider, newConfig.getProvider())) { this.provider = newConfig.getProvider(); hasChanged = true; } From ea5379d1614f4eb2ea7934dfa715b78afa2b1efb Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:20:08 +1000 Subject: [PATCH 04/19] fix(config): apply nested TLS settings during updates SECURITY: persist dynamic TLS policy changes --- .../config/network/impl/TlsConfig.java | 15 +++++++-------- 1 file changed, 7 insertions(+), 8 deletions(-) diff --git a/src/main/java/io/mapsmessaging/config/network/impl/TlsConfig.java b/src/main/java/io/mapsmessaging/config/network/impl/TlsConfig.java index bce8af281..e3b97cacb 100644 --- a/src/main/java/io/mapsmessaging/config/network/impl/TlsConfig.java +++ b/src/main/java/io/mapsmessaging/config/network/impl/TlsConfig.java @@ -23,7 +23,6 @@ import io.mapsmessaging.config.network.SslConfig; import io.mapsmessaging.configuration.ConfigurationProperties; import io.mapsmessaging.dto.rest.config.BaseConfigDTO; -import io.mapsmessaging.dto.rest.config.network.impl.TcpConfigDTO; import io.mapsmessaging.dto.rest.config.network.impl.TlsConfigDTO; import lombok.Data; import lombok.EqualsAndHashCode; @@ -38,21 +37,21 @@ public class TlsConfig extends TlsConfigDTO implements Config { public TlsConfig(ConfigurationProperties config) { NetworkConfigFactory.unpack(config, this); - sslConfig = new SslConfig(config); + sslConfig = new SslConfig(config, "tls"); if(sslConfig.getContext() == null || sslConfig.getContext().isEmpty()) { sslConfig.setContext("TLSv1.3"); } } public boolean update(BaseConfigDTO update) { - boolean hasChanged = false; - if (update instanceof TcpConfigDTO) { - hasChanged = NetworkConfigFactory.update(this, (TcpConfigDTO) update); - if(((SslConfig)sslConfig).update(update)){ - hasChanged = true; - } + if (!(update instanceof TlsConfigDTO newConfig)) { + return false; } + boolean hasChanged = NetworkConfigFactory.update(this, newConfig); + if (newConfig.getSslConfig() != null && ((SslConfig) sslConfig).update(newConfig.getSslConfig())) { + hasChanged = true; + } return hasChanged; } From 6ccff260e56517d24c5ddbd35c1c1c74c3323aff Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:20:21 +1000 Subject: [PATCH 05/19] fix(config): load and update nested DTLS settings SECURITY: use the DTLS security profile --- .../config/network/impl/DtlsConfig.java | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/src/main/java/io/mapsmessaging/config/network/impl/DtlsConfig.java b/src/main/java/io/mapsmessaging/config/network/impl/DtlsConfig.java index 2982557fb..e943da9eb 100644 --- a/src/main/java/io/mapsmessaging/config/network/impl/DtlsConfig.java +++ b/src/main/java/io/mapsmessaging/config/network/impl/DtlsConfig.java @@ -38,19 +38,20 @@ public class DtlsConfig extends DtlsConfigDTO implements Config { public DtlsConfig(ConfigurationProperties config) { setType("dtls"); NetworkConfigFactory.unpack(config, this); - sslConfig = new SslConfig(config); + sslConfig = new SslConfig(config, "dtls"); if(!sslConfig.getContext().toLowerCase().startsWith("dtls")){ sslConfig.setContext("DTLSv1.2"); } } public boolean update(BaseConfigDTO update) { - boolean hasChanged = false; - if (update instanceof DtlsConfigDTO) { - hasChanged = NetworkConfigFactory.update(this, (DtlsConfigDTO) update); - if(((SslConfig)sslConfig).update(update)){ - hasChanged = true; - } + if (!(update instanceof DtlsConfigDTO newConfig)) { + return false; + } + + boolean hasChanged = NetworkConfigFactory.update(this, newConfig); + if (newConfig.getSslConfig() != null && ((SslConfig) sslConfig).update(newConfig.getSslConfig())) { + hasChanged = true; } return hasChanged; } @@ -62,4 +63,5 @@ public ConfigurationProperties toConfigurationProperties() { security.put("dtls", ((SslConfig)sslConfig).toConfigurationProperties()); config.put("security", security); return config; - }} + } +} From 0e3ebc4f868f0d109c6ea378acfcf715be069ea0 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:20:29 +1000 Subject: [PATCH 06/19] fix(network): retain configured DTLS client authentication SECURITY: do not disable client certificates per session --- .../mapsmessaging/network/io/impl/dtls/DTLSSessionManager.java | 1 - 1 file changed, 1 deletion(-) diff --git a/src/main/java/io/mapsmessaging/network/io/impl/dtls/DTLSSessionManager.java b/src/main/java/io/mapsmessaging/network/io/impl/dtls/DTLSSessionManager.java index 56fbc5b41..c9c057c71 100644 --- a/src/main/java/io/mapsmessaging/network/io/impl/dtls/DTLSSessionManager.java +++ b/src/main/java/io/mapsmessaging/network/io/impl/dtls/DTLSSessionManager.java @@ -94,7 +94,6 @@ public boolean processPacket(@NonNull @NotNull Packet packet) throws IOException int mtu = 8192; paras.setMaximumPacketSize(mtu); paras.setEnableRetransmissions(true); - paras.setNeedClientAuth(false); sslEngine.setSSLParameters(paras); stateEngine = new StateEngine(packet.getFromAddress(), sslEngine, this); endPoint = new DTLSEndPoint(this, uniqueId.incrementAndGet(), packet.getFromAddress(), server, stateEngine, managerMBean); From 6e04810e861036689df437fcdad4f1b66cba16e3 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:20:42 +1000 Subject: [PATCH 07/19] fix(network): expose authenticated DTLS peer identity SECURITY: retain certificate identity after handshake --- .../network/io/impl/dtls/DTLSEndPoint.java | 22 +++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/src/main/java/io/mapsmessaging/network/io/impl/dtls/DTLSEndPoint.java b/src/main/java/io/mapsmessaging/network/io/impl/dtls/DTLSEndPoint.java index 16edbd82f..20b770370 100644 --- a/src/main/java/io/mapsmessaging/network/io/impl/dtls/DTLSEndPoint.java +++ b/src/main/java/io/mapsmessaging/network/io/impl/dtls/DTLSEndPoint.java @@ -21,6 +21,7 @@ import io.mapsmessaging.logging.Logger; import io.mapsmessaging.logging.LoggerFactory; +import io.mapsmessaging.logging.ServerLogMessages; import io.mapsmessaging.network.admin.EndPointJMX; import io.mapsmessaging.network.admin.EndPointManagerJMX; import io.mapsmessaging.network.io.*; @@ -33,7 +34,10 @@ import java.net.SocketAddress; import java.nio.channels.ClosedChannelException; import java.nio.channels.SelectionKey; +import java.security.Principal; import java.util.concurrent.FutureTask; +import javax.net.ssl.SSLEngine; +import javax.net.ssl.SSLPeerUnverifiedException; public class DTLSEndPoint extends EndPoint implements StateChangeListener, Timeoutable { @@ -128,6 +132,24 @@ public void handshakeComplete() { } } + @Override + public Principal getEndPointPrincipal() { + SSLEngine sslEngine = stateEngine.getSslEngine(); + if (sslEngine.getNeedClientAuth() || sslEngine.getWantClientAuth()) { + try { + return sslEngine.getSession().getPeerPrincipal(); + } catch (SSLPeerUnverifiedException e) { + logger.log(ServerLogMessages.SSL_ENGINE_CLIENT_AUTH); + } + } + return null; + } + + @Override + public boolean isSSL() { + return true; + } + @Override public boolean isUDP() { return true; From bd5839238b02421f6f7d792b36aa422863c381ad Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:20:51 +1000 Subject: [PATCH 08/19] fix(network): expose optional TLS client identity SECURITY: retain requested certificate identity --- .../java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java b/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java index bf11cef6e..8ca014611 100644 --- a/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java +++ b/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java @@ -231,7 +231,7 @@ private SSLEngineResult handleSSLEngineResult(SSLEngineResult result) throws IOE @Override public Principal getEndPointPrincipal() { - if (sslEngine.getNeedClientAuth()) { + if (sslEngine.getNeedClientAuth() || sslEngine.getWantClientAuth()) { try { return sslEngine.getSession().getPeerPrincipal(); } catch (SSLPeerUnverifiedException e) { From c9f32f4197b192c3ed7110d6adc187ab50d40607 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:21:06 +1000 Subject: [PATCH 09/19] fix(network): verify outbound TLS server hostnames SECURITY: enable configurable endpoint identification --- .../ssl/SSLEndPointConnectionFactory.java | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPointConnectionFactory.java b/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPointConnectionFactory.java index f9ff0abf6..fb3d6008e 100644 --- a/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPointConnectionFactory.java +++ b/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPointConnectionFactory.java @@ -33,6 +33,7 @@ import javax.net.ssl.SSLContext; import javax.net.ssl.SSLEngine; +import javax.net.ssl.SSLParameters; import java.io.IOException; import java.net.InetSocketAddress; import java.nio.channels.SocketChannel; @@ -49,8 +50,11 @@ public EndPoint connect(EndPointURL url, SelectorLoadManager selector, EndPointC throws IOException { TlsConfig securityProps = (TlsConfig) endPointServerStatus.getConfig().getEndPointConfig(); SSLContext context = SslHelper.createContext(securityProps.getSslConfig().getContext(),((Config) securityProps.getSslConfig()).toConfigurationProperties(), logger); - SSLEngine engine = SslHelper.createSSLEngine(context, ((Config)securityProps.getSslConfig()).toConfigurationProperties()); - engine.setUseClientMode(true); + SSLEngine engine = createClientEngine( + context, + url.getHost(), + url.getPort(), + securityProps.getSslConfig().isHostnameVerificationEnabled()); SocketChannel channel = SocketChannel.open(); InetSocketAddress address = new InetSocketAddress(url.getHost(), url.getPort()); channel.configureBlocking(true); @@ -59,6 +63,17 @@ public EndPoint connect(EndPointURL url, SelectorLoadManager selector, EndPointC return new SSLEndPoint(generateID(), engine, channel, selector.allocate(), callback, endPointServerStatus, jmxPath); } + static SSLEngine createClientEngine(SSLContext context, String host, int port, boolean hostnameVerificationEnabled) { + SSLEngine engine = context.createSSLEngine(host, port); + engine.setUseClientMode(true); + if (hostnameVerificationEnabled) { + SSLParameters sslParameters = engine.getSSLParameters(); + sslParameters.setEndpointIdentificationAlgorithm("HTTPS"); + engine.setSSLParameters(sslParameters); + } + return engine; + } + @Override public String getName() { return "ssl"; From 454e7ece808708ae58f6b00d3e39db6617d94061 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:21:14 +1000 Subject: [PATCH 10/19] fix(config): apply endpoint updates to stored state SECURITY: make dynamic TLS policy updates effective --- src/main/java/io/mapsmessaging/config/NetworkManagerConfig.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/io/mapsmessaging/config/NetworkManagerConfig.java b/src/main/java/io/mapsmessaging/config/NetworkManagerConfig.java index f0d26e0ee..76fa66db2 100644 --- a/src/main/java/io/mapsmessaging/config/NetworkManagerConfig.java +++ b/src/main/java/io/mapsmessaging/config/NetworkManagerConfig.java @@ -101,7 +101,7 @@ private boolean updateEndPointServerConfig(EndPointServerConfigDTO endPointServe } if(name.equals(endPointServerConfig.getName()) && endPointServerConfigDTO instanceof EndPointServerConfig) { - return ((EndPointServerConfig) endPointServerConfig).update(endPointServerConfigDTO); + return ((EndPointServerConfig) endPointServerConfigDTO).update(endPointServerConfig); } } return false; From 57ee0422155d89caa7924248aaca999a07e93535 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:21:23 +1000 Subject: [PATCH 11/19] docs(config): enable TLS hostname verification by default SECURITY: document CRL interval units --- src/main/resources/NetworkManager.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/main/resources/NetworkManager.yaml b/src/main/resources/NetworkManager.yaml index cf84be409..f165acee2 100644 --- a/src/main/resources/NetworkManager.yaml +++ b/src/main/resources/NetworkManager.yaml @@ -87,10 +87,11 @@ NetworkManager: tls: clientCertificateRequired: false clientCertificateWanted: false + hostnameVerificationEnabled: true #----------------------------------- # CRL Specific # crlUrl: - # crlInterval: