oscerd commented on code in PR #27803: URL: https://github.com/apache/camel/pull/27803#discussion_r4268834072
########## components/camel-smpp/src/main/docs/smpp-component.adoc: ########## @@ -166,8 +166,18 @@ If no *username* is provided, then Camel will provide the default value `smppclient`. + If no *port* number is provided, then Camel will provide the default value `2775`. + -If the protocol name is "smpps", camel-smpp with try to -use SSLSocket to init a connection to the server. +If the protocol name is "smpps", camel-smpp will try to +use SSLSocket to init a connection to the server. The certificate of the +server must be trusted by the JVM, and it must match the host Camel connects +to, with the same rules as an HTTPS client: a connection to an IP address +needs a certificate that lists that address as a subject alternative name. +Set `hostnameVerification=false` to turn the host check off. + +The handshake runs while the connection is being created, so a certificate that does not match makes the producer or +consumer fail to start with an `IOException` caused by an +`SSLHandshakeException: No subject alternative names matching IP address ... found` (or +`No name matching ... found` for a host name). An IP address has to be listed as a subject alternative name of the Review Comment: Right, and I checked it against the JDK rather than take it on trust. `sun.security.util.HostnameChecker.matchDNS` on 21.0.10: ``` 123: ldc // String No subject alternative names matching IP address 154: ldc // String No subject alternative DNS name matching 225: ldc // String Not a formal name 266: ldc // String No name matching ``` `No name matching` sits past the `checkAllSubjectAltNames` branch — it is only reached when there is no DNS SAN at all and the checker falls back to the CN, which is the case a modern certificate will not hit. Changed to your wording in `dd6a172`, in both the component page and the mirrored catalog copy, and reflowed the paragraph. I dropped the trailing full stop from the quoted fragment so it reads as an elision like the IP-address one next to it, rather than looking like punctuation inside the backticks. _Claude Code on behalf of oscerd_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
