diff --git a/akka-docs/src/main/paradox/remoting-artery.md b/akka-docs/src/main/paradox/remoting-artery.md index 4c2c283403..f0d1608361 100644 --- a/akka-docs/src/main/paradox/remoting-artery.md +++ b/akka-docs/src/main/paradox/remoting-artery.md @@ -333,6 +333,8 @@ It's recommended that you enable hostname verification with `akka.remote.artery.ssl.config-ssl-engine.hostname-verification=on`. When enabled it will verify that the destination hostname matches the hostname in the peer's certificate. +In deployments where hostnames are dynamic and not known up front it can make sense to leave the hostname verification off. + You have a few choices how to set up certificates and hostname verification: * Have a single set of keys and a single certificate for all nodes and *disable* hostname checking diff --git a/akka-remote/src/main/resources/reference.conf b/akka-remote/src/main/resources/reference.conf index 90ea5b8798..09d2981a21 100644 --- a/akka-remote/src/main/resources/reference.conf +++ b/akka-remote/src/main/resources/reference.conf @@ -1158,6 +1158,9 @@ akka { require-mutual-authentication = on # Set this to `on` to verify hostnames with sun.security.util.HostnameChecker + # If possible it is recommended to have this enabled. Hostname verification is designed for + # situations where things locate each other by hostname, in scenarios where host names are dynamic + # and not known up front it can make sense to have this disabled. hostname-verification = off } diff --git a/akka-remote/src/main/scala/akka/remote/artery/tcp/SSLEngineProvider.scala b/akka-remote/src/main/scala/akka/remote/artery/tcp/SSLEngineProvider.scala index 859c9065d1..aa73eaba09 100644 --- a/akka-remote/src/main/scala/akka/remote/artery/tcp/SSLEngineProvider.scala +++ b/akka-remote/src/main/scala/akka/remote/artery/tcp/SSLEngineProvider.scala @@ -88,12 +88,9 @@ class ConfigSSLEngineProvider(protected val config: Config, protected val log: M if (HostnameVerification) log.debug("TLS/SSL hostname verification is enabled.") else - log.warning( + log.info( LogMarker.Security, - "TLS/SSL hostname verification is disabled. " + - "Please configure akka.remote.artery.ssl.config-ssl-engine.hostname-verification=on " + - "and ensure the X.509 certificate on the host is correct to remove this warning. " + - "See Akka reference documentation for more information.") + "TLS/SSL hostname verification is disabled. See Akka reference documentation for more information.") constructContext() }