oscerd opened a new pull request, #28054: URL: https://github.com/apache/camel/pull/28054
Backport of #27824, with the test follow-up #27999, onto `camel-4.18.x`. **Original PRs:** #27824 - CAMEL-25645: camel-milo - let the OPC UA client validate the server certificate against a trust list, and #27999 - CAMEL-25645: camel-milo - ServerCertificateValidationTest writes the value before the consumers start **Target branch:** `camel-4.18.x` [CAMEL-25645](https://issues.apache.org/jira/browse/CAMEL-25645) ## What it does As on main, `milo-client` and `milo-browse` validate the certificate of the OPC UA server when the selected endpoint uses a security policy other than `None`: - New options: - `trustListDirectory`: Milo's file based trust list. It checks the chain, the validity period, the revocation status and the application URI. A CA-issued certificate needs a CRL of its CA in the trust list. - `certificateValidator`: a custom validator. - `trustAllCertificates`. - Without trust configuration, the client does not connect to such an endpoint, and logs a `WARN` that says why. - The same validator checks the certificate that the user name and password are encrypted with. - The last connection failure is the cause of `No connected`. ## Adaptations for camel-4.18.x The milo client code on this branch differs from main, so this is a hand port of the final state of #27824. It needs a review: - `@UriParam` has no `security` attribute on this branch, so `trustAllCertificates` is not marked `insecure:ssl`. There is no `SecurityUtils` registry to regenerate, and no catalog doc copies. - The user name and password only come from the endpoint URI on this branch (there are no `username`/`password` options). The validator is passed to that single `UsernameProvider`. - `SubscriptionManager` uses `synchronized` blocks instead of a lock, and `MiloClientConfiguration.clone()` is the copy constructor, which now copies the new options. - The connection cache id does not contain the requested publishing interval. The trust settings are appended to this branch's id. - Eclipse Milo 1.1.1 on this branch has every API the change uses. - The upgrade guide note for this branch goes into the 4.18 guide on main, in the 4.18.6 section. ## Tests - camel-milo: 58 tests, 0 failures, 1 skipped (`MonitorItemMultiConnectionsCertTest`, already `@Disabled`), including `ServerCertificateTrustTest`, `MiloClientConfigurationTest` and the end-to-end `ServerCertificateValidationTest`. - A full reactor build of the branch. _Claude Code on behalf of Andrea Cosentino_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
