Croway commented on code in PR #28188: URL: https://github.com/apache/camel/pull/28188#discussion_r4334589654
########## components/camel-ftp/src/main/docs/ftp-component.adoc: ########## @@ -80,6 +80,23 @@ include::partial$component-endpoint-headers.adoc[] == Usage +=== FTPS host name verification + +The FTPS client that Camel creates does not check that the certificate of the server matches the host of the endpoint: +any certificate accepted by the trust manager is accepted, whatever host it was issued for. To enable the check, set +`ftpClient.endpointCheckingEnabled=true` on the endpoint. The check uses the same rules as an HTTPS client, so a +connection to an IP address needs a certificate that lists that address as a subject alternative name. Review Comment: Done in 052575a: the section now says the check is done on the control connection, before login, and that data connections are not checked by host name. ########## components/camel-ftp/src/main/docs/ftp-component.adoc: ########## @@ -80,6 +80,23 @@ include::partial$component-endpoint-headers.adoc[] == Usage +=== FTPS host name verification + +The FTPS client that Camel creates does not check that the certificate of the server matches the host of the endpoint: +any certificate accepted by the trust manager is accepted, whatever host it was issued for. To enable the check, set +`ftpClient.endpointCheckingEnabled=true` on the endpoint. The check uses the same rules as an HTTPS client, so a +connection to an IP address needs a certificate that lists that address as a subject alternative name. + +Configure the trust material as well, with `sslContextParameters` or with the `ftpClient.trustStore.*` options (see +below), so that only certificates you trust are accepted: + +[source,text] +---- +ftps://[email protected]/inbox?password=secret&sslContextParameters=#sslContextParameters&ftpClient.endpointCheckingEnabled=true +---- + +From Camel 4.24 onwards the check is enabled by default, and controlled by the `hostnameVerification` option. Review Comment: Applied in 052575a. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
