gnodet-bot commented on code in PR #28188: URL: https://github.com/apache/camel/pull/28188#discussion_r4326446643
########## components/camel-ftp/src/main/docs/ftp-component.adoc: ########## @@ -80,6 +80,23 @@ include::partial$component-endpoint-headers.adoc[] == Usage +=== FTPS host name verification + +The FTPS client that Camel creates does not check that the certificate of the server matches the host of the endpoint: +any certificate accepted by the trust manager is accepted, whatever host it was issued for. To enable the check, set +`ftpClient.endpointCheckingEnabled=true` on the endpoint. The check uses the same rules as an HTTPS client, so a +connection to an IP address needs a certificate that lists that address as a subject alternative name. + +Configure the trust material as well, with `sslContextParameters` or with the `ftpClient.trustStore.*` options (see +below), so that only certificates you trust are accepted: + +[source,text] +---- +ftps://[email protected]/inbox?password=secret&sslContextParameters=#sslContextParameters&ftpClient.endpointCheckingEnabled=true +---- + +From Camel 4.24 onwards the check is enabled by default, and controlled by the `hostnameVerification` option. Review Comment: `camel-4.22.x` users reading this sentence will not have the `hostnameVerification` option available to them — it only arrives in 4.24. As written, it may read as if they can switch to that option now. A small clarification avoids confusion: ```suggestion From Camel 4.24 onwards the check is enabled by default and controlled by the `hostnameVerification` option; on earlier versions, use `ftpClient.endpointCheckingEnabled=true` as shown above. ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
