Ensure only NOOP hostname verifier is used for TLS

Because of Signering API using non-standard certificates for establishing TLS connection,
i.e. enterprise certificates (virksomhetssertifikat).

Apache Http Client changed behavior in v5.6, where it is not enough to
configure your own HostnameVerifier. To avoid the verification which is
built-in the JDK SSL stack, one must explicitly configure this policy to
HostnameVerificationPolicy.CLIENT.

https://lists.apache.org/thread/xycs1swxpdc4g3255ms0p1kshbl3ky29 (see
"Compatibility notes")

apache/httpcomponents-client@d89fdfe

Author: runeflobakk

lib/pom.xml

@@ -28,7 +28,7 @@
             <dependency>
                 <groupId>org.junit</groupId>
                 <artifactId>junit-bom</artifactId>
-                <version>5.13.0-M2</version>
+                <version>5.14.2</version>
                 <type>pom</type>
                 <scope>import</scope>
             </dependency>
@@ -74,18 +74,18 @@
         <dependency>
             <groupId>org.apache.httpcomponents.client5</groupId>
             <artifactId>httpclient5</artifactId>
-            <version>5.4.4</version>
+            <version>5.6</version>
         </dependency>
         <dependency>
             <groupId>org.apache.httpcomponents.core5</groupId>
             <artifactId>httpcore5</artifactId>
-            <version>5.3.4</version>
+            <version>5.4</version>
         </dependency>
 
         <dependency>
             <groupId>commons-io</groupId>
             <artifactId>commons-io</artifactId>
-            <version>2.19.0</version>
+            <version>2.21.0</version>
             <scope>test</scope>
         </dependency>
 

lib/src/main/java/no/digipost/signature/client/core/internal/configuration/ApacheHttpClientSslConfigurer.java

@@ -9,6 +9,7 @@
 import no.digipost.signature.client.security.OrganizationNumberValidation;
 import org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManagerBuilder;
 import org.apache.hc.client5.http.ssl.DefaultClientTlsStrategy;
+import org.apache.hc.client5.http.ssl.HostnameVerificationPolicy;
 import org.apache.hc.client5.http.ssl.NoopHostnameVerifier;
 import org.apache.hc.core5.ssl.SSLContexts;
 
@@ -40,7 +41,8 @@ public ApacheHttpClientSslConfigurer certificatChainValidation(CertificateChainV
 
     @Override
     public void applyTo(PoolingHttpClientConnectionManagerBuilder connectionManager) {
-        connectionManager.setTlsSocketStrategy(new DefaultClientTlsStrategy(sslContext(), NoopHostnameVerifier.INSTANCE));
+        connectionManager.setTlsSocketStrategy(
+                new DefaultClientTlsStrategy(sslContext(), HostnameVerificationPolicy.CLIENT, NoopHostnameVerifier.INSTANCE));
     }