JDK-8020207, jconsole fails connecting over SSL

[Gennadiy Krivoshein]

Hi serviceability-dev.

I would ask about the JConsole issue JDK-8020207 "jconsole fails connecting
over SSL using service:jmx:rmi://...jndi...",
https://bugs.openjdk.org/browse/JDK-8020207.
This issue was closed with resolutions "Won't fix'. I'm planning to reopen
this issue and start working on it and wanted to check if I'm missing
something before doing so.

The cause of the issue is a connection to the RMI registry. If the registry
and agent use SSLSockets and JConsole is trying to connect to the agent
using "service:jmx:rmi..." URL, ProxyClient of the JConsole does not
attempt to use SSL for communication with the registry, it always tries to
connect using not secured Socket.
A possible solution is to update one of ProxyClient's constructors -
'ProxyClient(String url, String userName, String password)' to check
schemas of the JMX service URL and registry's URL if the schemas are "rmi"
then check the registry's URL path. If the registry's URL path is a well
known "/jmxrmi" then set flag vmConnector to true and check SSL
configuration in the same way as with "host:port".

//// POSSIBLE SOLUTION

private ProxyClient(String url, String userName, String password) throws
IOException {
    this.advancedUrl = url;
    this.connectionName = getConnectionName(url, userName);
    this.displayName = connectionName;
    JMXServiceURL jmxServiceURL = new JMXServiceURL(url);
    if ("rmi".equals(jmxServiceURL.getProtocol())) {
        String path = jmxServiceURL.getURLPath();
        if (path.startsWith("/jndi/")) {
            int end = path.indexOf(';');
            if (end < 0) end = path.length();
            String registryURIStr = path.substring(6, end);
            URI registryURI = URI.create(registryURIStr);
            if ("rmi".equals(registryURI.getScheme())
                    && "/jmxrmi".equals(registryURI.getPath())) {
                this.registryHostName = registryURI.getHost();
                this.registryPort = registryURI.getPort();
                this.vmConnector = true;
                checkSslConfig();
            }
        }
    }
    setParameters(jmxServiceURL, userName, password);
}
//// END OF POSSIBLE SOLUTION

BR, Gennadiy.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mail.openjdk.org/pipermail/serviceability-dev/attachments/20250916/62fd2815/attachment.htm>