Re: [jetty-users] TLS ALPN ACME Lets Encrypt challange

[Info <info@xxxxxxxxxx>]

Hi, Simone,

I do need to create my own ALPNServerConnectionFactory because on 
startup of the OSGi environment the SPI FLY might be too early detecting 
ALPN processors.
My ALPNServerConnectionFactory implementation now has a OSGi 
ServiceTracker for ALPN processors dealing with the OSGi livecycle and 
initializing and adding any ALPNProcessor.Server services found.
The bundle implementing the ALPNServerConnectionFactory and the 
ALPNServerConnection is set on pax-web-jetty as a bundle fragment to 
expand its classpath so pax-web can execute the jetty.xml:

<Item>
    <New id="alpn" 
class="eu.abeel.platform.security.acme.api.JettyAlpnServerConnectionFactory">
        <Arg type="String">
            <Property name="jetty.alpn.protocols" default="acme-tls/1, 
http/1.1"/>
        </Arg>
        <Set name="defaultProtocol">
            <Property name="jetty.alpn.defaultProtocol" 
default="http/1.1"/>
         </Set>
    </New>
</Item>

Within the ALPNProcessor I was now expecting to solve the ACME 
(acme-tls/1) challenge, or am I mistaken about this handshake flow with 
Lets Encrypt?


On 24/11/2022 09:49, Simone Bordet wrote:
> Hi,
>
> On Wed, Nov 23, 2022 at 3:53 PM Info <info@xxxxxxxxxx> wrote:
> > Thanks for the answers so far, my current setup is working until the
> > service loader starts to search for ALPN processors.
> >
> > 2022-11-23T15:14:49,690 | WARN  | paxweb-config-1-thread-1 |
> > XmlConfiguration                 | 86 - org.eclipse.jetty.util -
> > 9.4.18.v20190429 | Config error at <Call id="wanhttpsConnector"
> > name="addConnector"><Arg>
> >
> > Caused by: java.lang.IllegalStateException: No Server ALPNProcessors!
> >
> > To make it even more difficult I am on an OSGi environment so I am
> > adding SPI FLY at the moment so the ALPNServerConnectionFactory can find
> > my ACME ALPN processor.
> You don't need to write your own ALPN processor.
>
> > If I understood correctly any call without an acme-tls/1 protocol header
> > (but with the default http/1.1 protocol) will just continue in the chain
> > into the handlers?
> You just specify jetty.alpn.protocols=acme-tls/1, http/1.1.
>
> A connection attempt that carries the TLS ALPN extension of
> "acme-tls/1" will complete the TLS handshake, but then it won't find a
> ConnectionFactory, so the connection will be closed.
>
> A connection attempt that carries the TLS ALPN extension of "http/1.1"
> will complete the TLS handshake, find the HttpConnectionFactory, and
> proceed handling HTTP requests that arrive on the connection.