Security

This section describes known issues and associated solutions related to Communications Server and web application security and certificates.

CA Certificate bundled with Communications Server 2.0 has expired (12287499)

Description

The CA certificate bundled with Communications Server 2.0 has expired since Jan 08, 2010. Hence some SEVERE log messages may be observed while starting the domain.

Solution

These messages are harmless but can be eliminated. Remove the expired certificate from the keystore. To remove the certificate from the JKS keystore, use the following command:

keytool delete -alias verisignserverca -keystore domain-dir/config/cacerts.jks

To remove the certificate from the NSS keystore, use the following command:

certutil -D -n verisignserverca -d domain-dir/config

OutofMemory Error in SSL Scenarios During Heavy Stress (JDK 6 Issue 23)

Description

A JDK bug (See: https://jdk6.dev.java.net/issues/show_bug.cgi?id=23) in JDK6 Sun PKCS11 Provider could cause an OutOfMemoryError when running certain SSL scenarios under heavy stress.

Solution

If you run into this issue, remove sun.security.pkcs11.SunPKCS11 provider from the java.security file in your JRE installation.

General Vulnerability Assessment (Issue 17287)

Description

An unspecified vulnerability in Oracle Sun GlassFish Enterprise Server 2.1, 2.1.1, and 3.0.1, and Sun Java System Application Server 9.1, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to Administration. See http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-0807.

Solution

Upgrade to Oracle GlassFish Server 3.1 or later.

SSL termination is not working (6269102)

Description

SSL termination is not working; when Load Balancer (Hardware) is configured for SSL termination, the Communications Server changes the protocol from https to http during redirection.

Solution

Add a software load balancer between the hardware load balancer and the Communications Server.

Socket connection leak with SSL (6492477)

Description

Because of a JVM bug, there is a leak issue with some JDK versions when security-enabled is set to true on an HTTP listener. Specifically, the steps to reproduce this bug are as follows:

1. Set security-enabled to true on the HTTP listener:

   <http-listener acceptor-threads="1" address="0.0.0.0" 
   blocking-enabled="false" default-virtual-server="server" enabled="true" 
   family="inet" id=" http-listener-1" port="8080" security-enabled="true" 
   server-name="" xpowered-by="true">

2. Comment out stopping domain at the end of quicklook tests.

3. Run quicklook tests.

4. Check socket usage:

   netstat -an | grep 8080

   The following are shown to be in use:

   *.8080               *.*                0      0 49152      0 LISTEN
   *.8080               *.*                0      0 49152      0 BOUND

This issue is tracked on the GlassFish site at http://java.net/jira/browse/GLASSFISH-849.

Solution

Upgrade to the latest JDK version.