This is an automated email from the ASF dual-hosted git repository.
Croway pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 26c899d818b8 CAMEL-24443: camel-knative - do not trust every
certificate when SSL is enabled without a truststore (#25824)
26c899d818b8 is described below
commit 26c899d818b8f33732da3678ae00de6af351b622
Author: Andrea Cosentino <[email protected]>
AuthorDate: Fri Aug 28 11:46:09 2026 +0200
CAMEL-24443: camel-knative - do not trust every certificate when SSL is
enabled without a truststore (#25824)
KnativeSslClientOptions.configureOptions() installed
TrustAllOptions.INSTANCE - a
trust manager that accepts every certificate - whenever
camel.knative.client.ssl.enabled
was true and neither truststore.path nor trust.cert.path was set. No option
named
trustAll was involved: enabling TLS was itself what turned certificate
validation off.
Hostname verification in the same method already defaults to true, so the
trust
decision was the outlier, and KnativeOidcClientOptions extends this class.
Leave the trust options unset in that case instead, so the JVM default
trust anchors
apply - the fallback SSLContextParameters and the rest of Camel use.
Accepting any
certificate stays available behind the new
camel.knative.client.ssl.trust.all property,
which defaults to false.
KnativeHttpTest.testSecureClientOptionsPropertyConf configures SSL entirely
through
properties against a self-signed test server, so it relied on the old
fallback; it now
sets trust.all explicitly, which is the same migration an affected
deployment makes.
Signed-off-by: Andrea Cosentino <[email protected]>
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
Co-authored-by: Federico Mariani <[email protected]>
---
.../knative/http/KnativeSslClientOptions.java | 8 ++-
.../component/knative/http/KnativeHttpTest.java | 3 +
.../http/KnativeSslClientOptionsTrustTest.java | 66 ++++++++++++++++++++++
.../ROOT/pages/camel-4x-upgrade-guide-4_23.adoc | 16 ++++++
4 files changed, 92 insertions(+), 1 deletion(-)
diff --git
a/components/camel-knative/camel-knative-http/src/main/java/org/apache/camel/component/knative/http/KnativeSslClientOptions.java
b/components/camel-knative/camel-knative-http/src/main/java/org/apache/camel/component/knative/http/KnativeSslClientOptions.java
index 65ec42fa3da9..67ac05a7ce4e 100644
---
a/components/camel-knative/camel-knative-http/src/main/java/org/apache/camel/component/knative/http/KnativeSslClientOptions.java
+++
b/components/camel-knative/camel-knative-http/src/main/java/org/apache/camel/component/knative/http/KnativeSslClientOptions.java
@@ -116,10 +116,16 @@ public class KnativeSslClientOptions extends
WebClientOptions implements CamelCo
} else if (trustCertPath.isPresent()) {
String[] trustCertPathItems = trustCertPath.get().split(",");
setTrustCertPath(trustCertPathItems);
- } else {
+ } else if (Boolean.parseBoolean(
+ propertiesComponent.resolveProperty(PROPERTY_PREFIX +
"trust.all").orElse("false"))) {
+ // Explicitly asked for. Useful against a development cluster
with a self-signed
+ // certificate, but it has to be requested rather than being
what "no truststore" means.
trustOptions = TrustAllOptions.INSTANCE;
setTrustOptions(trustOptions);
}
+ // Otherwise leave the trust options unset, so the JVM default
trust anchors apply - the same
+ // fallback SSLContextParameters and the rest of Camel use.
Turning TLS on must not be the
+ // thing that turns certificate validation off.
}
}
diff --git
a/components/camel-knative/camel-knative-http/src/test/java/org/apache/camel/component/knative/http/KnativeHttpTest.java
b/components/camel-knative/camel-knative-http/src/test/java/org/apache/camel/component/knative/http/KnativeHttpTest.java
index 98edbf1e7d29..c9080f3c5893 100644
---
a/components/camel-knative/camel-knative-http/src/test/java/org/apache/camel/component/knative/http/KnativeHttpTest.java
+++
b/components/camel-knative/camel-knative-http/src/test/java/org/apache/camel/component/knative/http/KnativeHttpTest.java
@@ -2257,6 +2257,9 @@ public class KnativeHttpTest {
context.getPropertiesComponent().addInitialProperty("camel.knative.client.ssl.verify.hostname",
"false");
context.getPropertiesComponent().addInitialProperty("camel.knative.client.ssl.key.path",
"keystore/client.pem");
context.getPropertiesComponent().addInitialProperty("camel.knative.client.ssl.key.cert.path",
"keystore/client.crt");
+ // The test server presents a self-signed certificate. Enabling SSL no
longer implies trusting every
+ // certificate, so the trust decision has to be made here.
+
context.getPropertiesComponent().addInitialProperty("camel.knative.client.ssl.trust.all",
"true");
KnativeComponent component = configureKnativeComponent(
context,
diff --git
a/components/camel-knative/camel-knative-http/src/test/java/org/apache/camel/component/knative/http/KnativeSslClientOptionsTrustTest.java
b/components/camel-knative/camel-knative-http/src/test/java/org/apache/camel/component/knative/http/KnativeSslClientOptionsTrustTest.java
new file mode 100644
index 000000000000..2abecc3a4da2
--- /dev/null
+++
b/components/camel-knative/camel-knative-http/src/test/java/org/apache/camel/component/knative/http/KnativeSslClientOptionsTrustTest.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.component.knative.http;
+
+import java.util.Properties;
+
+import org.apache.camel.CamelContext;
+import org.apache.camel.impl.DefaultCamelContext;
+import org.junit.jupiter.api.Test;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+/**
+ * Enabling SSL is not a request to stop validating certificates. With no
truststore and no trust certificates
+ * configured the client has to fall back to the JVM default trust anchors,
the way the rest of Camel does; accepting
+ * every certificate is available, but only when it is asked for.
+ */
+class KnativeSslClientOptionsTrustTest {
+
+ @Test
+ void sslEnabledWithoutATruststoreDoesNotTrustEveryCertificate() throws
Exception {
+ try (CamelContext context =
contextWith("camel.knative.client.ssl.enabled", "true")) {
+ KnativeSslClientOptions options = new
KnativeSslClientOptions(context);
+
+ assertThat(options.isSslEnabled()).isTrue();
+ // Left unset, so Vert.x falls back to the JVM default trust
anchors
+ assertThat(options.getTrustOptions()).isNull();
+ }
+ }
+
+ @Test
+ void trustAllIsAvailableButHasToBeRequested() throws Exception {
+ try (CamelContext context = contextWith(
+ "camel.knative.client.ssl.enabled", "true",
+ "camel.knative.client.ssl.trust.all", "true")) {
+ KnativeSslClientOptions options = new
KnativeSslClientOptions(context);
+
+
assertThat(options.getTrustOptions()).isInstanceOf(TrustAllOptions.class);
+ }
+ }
+
+ private static CamelContext contextWith(String... keyValues) throws
Exception {
+ Properties properties = new Properties();
+ for (int i = 0; i < keyValues.length; i += 2) {
+ properties.setProperty(keyValues[i], keyValues[i + 1]);
+ }
+ CamelContext context = new DefaultCamelContext();
+ context.getPropertiesComponent().setInitialProperties(properties);
+ context.start();
+ return context;
+ }
+}
diff --git
a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
index a83d5cfaef0a..802926eeedab 100644
--- a/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
+++ b/docs/user-manual/modules/ROOT/pages/camel-4x-upgrade-guide-4_23.adoc
@@ -438,6 +438,7 @@ Ordinary listings are unaffected, as a listed name is
normally a single path seg
resolves back inside the polled directory remains accepted. Two configurations
can newly see files skipped: a
server that reports names navigating above the polled directory, and a
`fileName` expression (used when
`useList=false`) that navigates above it. Set `jailStartingDirectory=false` if
such a path is intended.
+
=== camel-as2
The AS2 server no longer attaches the configured `mdnUserName` / `mdnPassword`
/ `mdnAccessToken`
@@ -475,6 +476,7 @@ to `CamelIBMCOSCacheControl`, so the header name matches
the Cache-Control metad
breaking change for routes that reference the header by its literal string
name: they must switch to
`CamelIBMCOSCacheControl`, although the change is trivial to adapt. Routes
using the
`IBMCOSConstants.CACHE_CONTROL` constant are unaffected.
+
=== camel-knative
The Knative HTTP consumer no longer returns the stack trace of a failed
exchange to the caller.
@@ -499,6 +501,20 @@ knative:endpoint/myEndpoint?muteException=false
argument for the flag. The three-argument constructor is retained and mutes
the exception, so existing
code compiles unchanged and picks up the new default.
+Setting `camel.knative.client.ssl.enabled=true` without also configuring
+`camel.knative.client.ssl.truststore.path` or
`camel.knative.client.ssl.trust.cert.path` used to install
+a trust manager that accepts every certificate, so enabling TLS was what
disabled certificate
+validation. No option named `trustAll` was involved.
+
+The client now leaves the trust options unset in that case, which means the
JVM default trust anchors
+apply — the same fallback `SSLContextParameters` and the rest of Camel use.
Accepting any certificate is
+still available, but has to be asked for with the new
+`camel.knative.client.ssl.trust.all=true` property.
+
+Deployments that relied on the previous behaviour — a development cluster with
a self-signed
+certificate, for example — must either configure a truststore or set
`camel.knative.client.ssl.trust.all`
+explicitly. `KnativeOidcClientOptions` extends this class and is affected the
same way.
+
=== camel-paho-mqtt5
When `automaticReconnect=true` and the MQTT broker reconnects, the consumer
now restarts the route
