Register template from URL does not work with HTTPS and SNI

[olivierlemasle]

ISSUE TYPE

• Bug Report

COMPONENT NAME

SSVM

CLOUDSTACK VERSION

4.15.0

CONFIGURATION

N/A

OS / ENVIRONMENT

N/A

SUMMARY

The http(s) client used by the SSVM to download templates does not support SNI (Server Name Indication).

Templates available on webservers using https and SNI (e.g. behind Cloudfront) cannot be downloaded.

STEPS TO REPRODUCE

Register template from URL, with e.g.:

• URL: https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/33.20201214.3.1/x86_64/fedora-coreos-33.20201214.3.1-vmware.x86_64.ova (for OVA) or https://builds.coreos.fedoraproject.org/prod/streams/stable/builds/33.20201214.3.1/x86_64/fedora-coreos-33.20201214.3.1-digitalocean.x86_64.qcow2.gz (for qcow2)
• direct download: false

EXPECTED RESULTS

Template is expected to be downloaded in the zone.

ACTUAL RESULTS

Template download fails in the zone, with message:

Received fatal alert: handshake_failure

Temporary fix

1. Log in the SSVM using SSH
2. Edit /usr/local/cloud/systemvm/_run.sh to replace -Djsse.enableSNIExtension=false by -Djsse.enableSNIExtension=true
3. Restart the SSVM

[DaanHoogland]

seems like a trivial change, I wonder if the enableSNIExtension=false was set on purpose.
cc @nvazquez (and maybe @sureshanaparti)?

[olivierlemasle]

I wonder if the enableSNIExtension=false was set on purpose.

I wonder, too...

As I wrote in PR #4588, enableSNIExtension=false was added in commit 1d45b75; the commit message includes:

Java 1.7 - disable using SNI since copyTemplate doesnt work for SSL.

[yadvr]

Ping @olivierlemasle are you working on the PR #4588 ?