2

I want to call a REST service running outside OpenShift via a Service and external domain name. This works perfect with a http:// request. The mechanism is described in the documentation : https://docs.okd.io/latest/dev_guide/integrating_external_services.html#saas-define-service-using-fqdn

However the external service is secured with https. In this case I got the following exception: Host name 'external-test-service' does not match the certificate subject provided by the peer (CN=.xxx, O=xxx, L=xxx, ST=GR, C=CH); nested exception is javax.net.ssl.SSLPeerUnverifiedException: Host name 'external-test-service' does not match the certificate subject provided by the peer (CN=.xxx, O=xxx, L=xxx, ST=GR, C=CH)

The exception is clear to me because we use the Service name from OpenShift. This name does not correspond to the origin host name in the certificate. So currently I see three possibilities to solve this issue:

  1. Add the name of the OpenShift Service to the certificate
  2. Deactivate hostname verification before calling the external REST service
  3. Configure OpenShift (don't know this is possible)

Has anybody solve this or a similar issue?

Currently I used OpenShift v3.9. We are running a simple Spring Boot application in a pod accessing REST services outside OpenShift.

Any hint will be appreciated.

Thank you

Markus

1 Answer 1

1
  1. Ugly and might cost you extra $$
  2. Defeats the purpose of TLS.
  3. On Kubernetes 1.10 and earlier you can use ExternalName.

    You can also use with OpenShift.

  4. You can also use and Kubernetes Ingress with TLS. Also, documented for OpenShift

Hope it helps!

4
  • Thanks for you're response. But we are using already ExternalName feature. That is the problem. The certificate from the external services is available as keystore in our Spring Boot application. We configured a Service with ExternalName type. This works perfectly with http://... When we use https:// in our application as URL for the external service we got the exception concerning the hostname. So from my perspective the error will be thrown by the Spring Boot application before the service name can be mapping to the real hostname.
    – Markus
    Sep 20, 2018 at 10:07
  • Have you tried a L7 ingress with TLS? I added it to the answer.
    – Rico
    Sep 20, 2018 at 14:10
  • Hi, we didn't try it with Ingress. However Ingress will be used to expose services running within the OpenShift cluster. However we want to use a service that runs outside OpenShift with the Service Layer from OpenShift.
    – Markus
    Sep 20, 2018 at 21:22
  • Seems convoluted. You could just terminate SSL on that Service Layer whatever it is and use self-signed certs inside.
    – Rico
    Sep 20, 2018 at 21:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.