Rest-assured: RestAssured.useRelaxedHTTPSValidation() is ignored on http requests.

[blindenvy]

We have a web application that enforces SSL connections. So when a request is made to http://example.com:9080/myapp it will automatically be forwarded to https://example.com:9443/myapp. In our testing environments we use a self signed certificate that is generated on the fly and is not easily accessed thus our Rest Assured tests need to just ignore HTTPS Validation. I have observed the following:

Failing test:

    @Test
    public void basicPingTest() {
        RestAssured.authentication = basic("foo", "bar");
        RestAssured.baseURI = "http://example.com:9080/myapp";
        RestAssured.useRelaxedHTTPSValidation();
        given().when().get().then().statusCode(200);
    }

Fails with error:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at com.exampleTestServiceIT.basicPingTest(TestServiceIT.java:34)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at com.example.TestServiceIT.basicPingTest(TestServiceIT.java:34)
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at com.example.TestServiceIT.basicPingTest(TestServiceIT.java:34)

Working test:

    @Test
    public void basicPingTest() {
        RestAssured.authentication = basic("foo", "bar");
        RestAssured.baseURI = "https://example.com:9443/myapp";
        RestAssured.useRelaxedHTTPSValidation();
        given().when().get().then().statusCode(200);
    }

It appears that the useRelaxedHTTPSValidation configuration is ignored when the original request is using an http scheme. Is this an oversight in the design?

[vikramvi]

Refer to SSLITest.java for other examples as well

[pavelpp]

Example url that throws such exception
http://www.bupa.com.au/

[swati-joshi-github]

@blindenvy We also have the same scenario as your project but in our case even with Base URI "https://localhost:8443" it is not working on tomcat server. We also have auto redirecting from http to https.

My Test case code looks like this
RestAssured.baseURI = "https://localhost:8443/some/rest/";
RestAssured.useRelaxedHTTPSValidation();
RestAssured.given().when().get("role/listAll").then().statusCode(200);

Getting below error
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.Alerts.getSSLException(Unknown Source)
at sun.security.ssl.SSLSocketImpl.recvAlert(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)

Please guide. Thanks in advance!

[marynazlotko]

Hi! Any updates on when this is going to be fixed?

[hello-ming]

not fixed yet, just use url with https to avoid this issue