samipeltola81 opened a new issue, #9185:
URL: https://github.com/apache/camel-quarkus/issues/9185
### Bug description
**Summary**
camel-quarkus-tls-registry's bridged SSLContextParameters bean is resolvable
and produces a working SSLContext when invoked directly, but Kafka connections
using the same bean via sslContextParameters=#<name> fail PKIX path validation
— indicating the custom trust store isn't actually applied to the Kafka
client's SSL context, which instead appears to fall back to the JVM default
trust store.
**Environment**
Camel Quarkus: 3.39.0 and 3.39.3 (reproduced on both)
camel-quarkus-tls-registry (experimental)
Reproduced in both quarkus:dev and packaged (java -jar quarkus-run.jar) —
not dev-mode-specific
**Steps to Reproduce**
1. Configure quarkus.tls.kafka-tls.* with PKCS12 key-store + trust-store
(chained root → intermediate → leaf CA)
2. Reference it on a camel-kafka endpoint: sslContextParameters=#kafka-tls,
securityProtocol=SSL
3. Confirm TlsConfigurationRegistry.get("kafka-tls") returns populated
PfxOptions for both stores
4. Confirm camelContext.getRegistry().lookupByName("kafka-tls") returns a
non-null SSLContextParameters
5. Call createSSLContext() on that bean directly and complete a manual TLS
handshake against the broker → succeeds
6. Start the actual Camel Kafka route against the same broker → fails: PKIX
path building failed: unable to find valid certification path to requested
target
I've attached Claude code generated Docker compose file and script for
generating required certs, as well as a minimal project for reproducing.
Running with "dev" profile works when using manual SSLContextParameters bean
creation.
Running with "tls-registry" profile fails when using TLS registry to bridge
the bean to Camel.
Using "-Djavax.net.debug=ssl:handshake:trustmanager" shows verbose logging
about certificate handling.
[docker-compose.yml](https://github.com/user-attachments/files/32367556/docker-compose.yml)
[generate-certs.sh](https://github.com/user-attachments/files/32367555/generate-certs.sh)
[tls-registry-reproducer.zip](https://github.com/user-attachments/files/32367569/tls-registry-reproducer.zip)
**Actual**
Handshake fails with a PKIX error consistent with the trust store not being
applied, despite the bean being present, resolvable, and independently
confirmed functional.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
