Enforce hostname verification by default for TLS connections#4495
Merged
ggivo merged 5 commits intoApr 24, 2026
Conversation
Enable HTTPS endpoint identification algorithm by default in DefaultJedisSocketFactory when ssl(true) is used without custom SSLParameters. Add tests (Jedis, RedisClient, RedisClusterClient, RedisSentinelClient) to verify hostname verification failure when certificate CN/SAN doesn't match the connection hostname. Users can still override by providing custom SSLParameters. Fixes: CAE-2794
🛡️ Jit Security Scan Results
✅ No security findings were detected in this PR
Security scan by Jit
|
Test Results 191 files ±0 191 suites ±0 11m 37s ⏱️ +18s Results for commit 8c2c3ac. ± Comparison against base commit fa219c3. This pull request removes 7 and adds 9 tests. Note that renamed tests count towards both.This pull request skips 407 tests.♻️ This comment has been updated with latest results. |
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 36fed37. Configure here.
…Options" This reverts commit 36fed37.
uglide
reviewed
Apr 24, 2026
…ters config Mark legacy SSL configuration (ssl, sslSocketFactory, sslParameters getters and builder setters) as @deprecated since 7.4.2 in favor of SslOptions, and update JedisClientConfig / SslOptions Javadoc.
uglide
approved these changes
Apr 24, 2026
ggivo
added a commit
that referenced
this pull request
Apr 24, 2026
…S connections (#4497) * Enforce hostname verification by default for TLS connections Enable HTTPS endpoint identification algorithm by default in DefaultJedisSocketFactory when ssl(true) is used without custom SSLParameters. Add tests (Jedis, RedisClient, RedisClusterClient, RedisSentinelClient) to verify hostname verification failure when certificate CN/SAN doesn't match the connection hostname. Users can still override by providing custom SSLParameters. Fixes: CAE-2794 * DefaultJedisClientConfig#builder(URI redisUri) updated to SslOptions * Revert "DefaultJedisClientConfig#builder(URI redisUri) updated to SslOptions" This reverts commit 36fed37. * docs(ssl): recommend SslOptions; deprecate SSLSocketFactory/SSLParameters config Mark legacy SSL configuration (ssl, sslSocketFactory, sslParameters getters and builder setters) as @deprecated since 7.4.2 in favor of SslOptions, and update JedisClientConfig / SslOptions Javadoc.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes hostname verification bypass when using simple TLS configuration (
ssl=true)and deprecates the low-level SSL configuration methods in favor of
SslOptions.Changes
DefaultJedisSocketFactoryJedisClientConfig.getSslSocketFactory()/getSslParameters()and builder settersssl(boolean)/sslSocketFactory(...)/sslParameters(...)as@Deprecatedsince 7.4.2 in favor ofSslOptions.isSsl()remains as the query method for "is TLS enabled?".SslOptions.defaults()factory for a clean migration fromssl(true)JedisClientConfig(interface-contract style) andSslOptions(verification modes, truststore examples)RedisClient, RedisClusterClient, RedisSentinelClient)
Behavior change
Before:
ssl(true)accepted any certificate without hostname verificationAfter:
ssl(true)enforces hostname verification by defaultMigration
Recommended: switch to
SslOptionsFor TLS with JVM defaults (truststore, full verification):
For custom truststores, mutual TLS, or other TLS options use
SslOptions.builder()(see
SslOptionsJavadoc for examples).Fallback to previous behaviour (hostname verification disabled)
Preferred: use
SslOptionswithSslVerifyMode.CAValidates the certificate chain but skips hostname verification. Use this when
connecting via IP or a name not listed in the certificate's SAN/CN:
Alternative: override with custom
SSLParameters(deprecated path)Note: Both options disable hostname verification. Prefer
SslVerifyMode.CAover custom
SSLParameters— it is more explicit, still verifies the certificatechain, and leaves other
SSLParametersdefaults untouched. Only use in trustedenvironments.
Fixes
Note
High Risk
Changes TLS connection defaults to enable hostname verification, which is security-sensitive and can break existing deployments that connect via IP/incorrect hostnames. Also introduces deprecations and new test endpoints that may affect downstream builds relying on previous legacy SSL behavior.
Overview
Enforces secure-by-default TLS by enabling HTTPS hostname verification on TLS sockets when using the legacy
ssl(true)path (i.e., when noSslOptions/customSSLParametersare provided), preventing hostname-verification bypasses.Deprecates legacy SSL knobs (
JedisClientConfig#getSslSocketFactory(),getSslParameters(), andDefaultJedisClientConfig.Buildersettersssl(...),sslSocketFactory(...),sslParameters(...)) in favor ofSslOptions, and addsSslOptions.defaults()plus expanded Javadoc to guide migration.Adds integration coverage and fixtures for hostname verification across
Jedis,RedisClient,RedisClusterClient, andRedisSentinelClient, including new “wrong host” endpoints/config to assert failures by default and success when explicitly disabling endpoint identification via customSSLParameters.Reviewed by Cursor Bugbot for commit 8c2c3ac. Bugbot is set up for automated code reviews on this repo. Configure here.