Merge pull request #79 from fingerprintjs/inter-1895-akamai-fix-ssl

INTER-1895 Fix SSL Mismatch

Author: Orkuncakilkaya

assets/rulesTemplate.json

@@ -145,15 +145,24 @@
             "cacheKeyHostname": "ORIGIN_HOSTNAME",
             "compress": true,
             "enableTrueClientIp": false,
-            "verificationMode": "THIRD_PARTY",
+            "verificationMode": "CUSTOM",
             "originSni": true,
             "httpPort": 80,
             "httpsPort": 443,
             "hostname": "{{user.PMUSER_FPJS_PROCDN_ENDPOINT}}",
             "originCertificate": "",
             "ports": "",
             "ipVersion": "DUALSTACK",
-            "minTlsVersion": "DYNAMIC"
+            "minTlsVersion": "DYNAMIC",
+            "customValidCnValues": [
+              "{{Origin Hostname}}",
+              "{{Forward Host Header}}"
+            ],
+            "originCertsToHonor": "STANDARD_CERTIFICATE_AUTHORITIES",
+            "standardCertificateAuthorities": [
+              "akamai-permissive",
+              "THIRD_PARTY_AMAZON"
+            ]
           }
         },
         {
@@ -339,7 +348,7 @@
             "cacheKeyHostname": "ORIGIN_HOSTNAME",
             "compress": true,
             "enableTrueClientIp": true,
-            "verificationMode": "THIRD_PARTY",
+            "verificationMode": "CUSTOM",
             "originSni": true,
             "httpPort": 80,
             "httpsPort": 443,
@@ -349,7 +358,16 @@
             "ipVersion": "DUALSTACK",
             "trueClientIpHeader": "FPJS-Proxy-Client-IP",
             "trueClientIpClientSetting": false,
-            "minTlsVersion": "DYNAMIC"
+            "minTlsVersion": "DYNAMIC",
+            "customValidCnValues": [
+              "{{Origin Hostname}}",
+              "{{Forward Host Header}}"
+            ],
+            "originCertsToHonor": "STANDARD_CERTIFICATE_AUTHORITIES",
+            "standardCertificateAuthorities": [
+              "akamai-permissive",
+              "THIRD_PARTY_AMAZON"
+            ]
           }
         },
         {
@@ -415,15 +433,24 @@
             "cacheKeyHostname": "ORIGIN_HOSTNAME",
             "compress": true,
             "enableTrueClientIp": false,
-            "verificationMode": "THIRD_PARTY",
+            "verificationMode": "CUSTOM",
             "originSni": true,
             "httpPort": 80,
             "httpsPort": 443,
             "hostname": "{{user.PMUSER_FPJS_INGRESS_ENDPOINT}}",
             "originCertificate": "",
             "ports": "",
             "minTlsVersion": "DYNAMIC",
-            "ipVersion": "DUALSTACK"
+            "ipVersion": "DUALSTACK",
+            "customValidCnValues": [
+              "{{Origin Hostname}}",
+              "{{Forward Host Header}}"
+            ],
+            "originCertsToHonor": "STANDARD_CERTIFICATE_AUTHORITIES",
+            "standardCertificateAuthorities": [
+              "akamai-permissive",
+              "THIRD_PARTY_AMAZON"
+            ]
           }
         },
         {

scripts/deployRules.ts

@@ -32,6 +32,47 @@ const createNewVersion = async (propertyId: string) => {
   return getLatestVersion(propertyId)
 }
 
+const patchDefaultRuleOrigin = async (propertyId: string, version: string) =>
+    akamaiRequest({
+        path: `/papi/v1/properties/${propertyId}/versions/${version}/rules?contractId=${process.env.AK_CONTRACT_ID}&groupId=${process.env.AK_GROUP_ID}`,
+        method: 'PATCH',
+        headers: {
+            'Content-Type': 'application/json-patch+json',
+        },
+        body: JSON.stringify([
+            {
+                op: 'add',
+                path: '/rules/behaviors/0/options/customValidCnValues',
+                value: [
+                    "{{Forward Host Header}}",
+                    "{{Origin Hostname}}"
+                ]
+            },
+            {
+                op: 'replace',
+                path: '/rules/behaviors/0/options/verificationMode',
+                value: "CUSTOM"
+            },
+            {
+                op: 'add',
+                path: '/rules/behaviors/0/options/originCertsToHonor',
+                value: "STANDARD_CERTIFICATE_AUTHORITIES"
+            },
+            {
+                op: 'add',
+                path: '/rules/behaviors/0/options/standardCertificateAuthorities',
+                value: [
+                    "THIRD_PARTY_AMAZON",
+                    "akamai-permissive"
+                ]
+            },
+            {
+                op: 'remove',
+                path: '/rules/behaviors/1',
+            }
+        ])
+    })
+
 const patchOriginHostname = async (propertyId: string, version: string) =>
   akamaiRequest({
     path: `/papi/v1/properties/${propertyId}/versions/${version}/rules?contractId=${process.env.AK_CONTRACT_ID}&groupId=${process.env.AK_GROUP_ID}`,
@@ -130,6 +171,7 @@ import('../dist/patch-body/body.json').then((module) => {
       } catch (_) {
         // Ignore error if fingerprint rules not exists
       }
+      await patchDefaultRuleOrigin(propertyId, propertyVersion)
       await patchAddFingerprintRules(propertyId, propertyVersion, JSON.stringify(patchReqBody))
       await activateVersion(propertyId, propertyVersion)
     } catch (e: any) {