oscerd opened a new pull request, #28053: URL: https://github.com/apache/camel/pull/28053
Backport of #27824, with the test follow-up #27999, onto `camel-4.22.x`. **Original PRs:** #27824 - CAMEL-25645: camel-milo - let the OPC UA client validate the server certificate against a trust list, and #27999 - CAMEL-25645: camel-milo - ServerCertificateValidationTest writes the value before the consumers start **Target branch:** `camel-4.22.x` [CAMEL-25645](https://issues.apache.org/jira/browse/CAMEL-25645) ## What it does As on main, `milo-client` and `milo-browse` validate the certificate of the OPC UA server when the selected endpoint uses a security policy other than `None`: - New options: - `trustListDirectory`: Milo's file based trust list. It checks the chain, the validity period, the revocation status and the application URI. A CA-issued certificate needs a CRL of its CA in the trust list. - `certificateValidator`: a custom validator. - `trustAllCertificates`: marked `insecure:ssl`. - Without trust configuration, the client does not connect to such an endpoint, and logs a `WARN` that says why. - The same validator checks the certificate that the user name and password are encrypted with. - The last connection failure is the cause of `No connected`. ## Adaptations for camel-4.22.x This is not a straight cherry-pick, so it needs a review: - On this branch the connection cache id does not contain the requested publishing interval. The conflict in `MiloClientConfiguration.toCacheId()` keeps this branch's id and appends the trust settings, and `MiloClientConfigurationTest` expects the endpoint URI alone without trust settings. - The generated files are regenerated for this branch. `SecurityUtils` on this branch is keyed by option name only, and its existing `trustallcertificates` entry already covers the new option. - The 4.24 upgrade guide is not part of this backport. The note for this branch goes into the 4.22 guide on main, in a new 4.22.3 section, because 4.22.2 was already tagged. ## Tests - camel-milo: 60 tests, 0 failures, 1 skipped (`MonitorItemMultiConnectionsCertTest`, already `@Disabled`), including `ServerCertificateTrustTest`, `MiloClientConfigurationTest` and the end-to-end `ServerCertificateValidationTest`. - A full reactor build of the branch. _Claude Code on behalf of Andrea Cosentino_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
