This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch camel-4.18.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.18.x by this push:
new b2f6d9d83694 [camel-4.18.x] CAMEL-25890: camel-ftp - document how to
enable FTPS host name verification (#28189)
b2f6d9d83694 is described below
commit b2f6d9d83694c20212b390a9da192d702e47fbe4
Author: Federico Mariani <[email protected]>
AuthorDate: Wed Oct 21 12:54:30 2026 +0200
[camel-4.18.x] CAMEL-25890: camel-ftp - document how to enable FTPS host
name verification (#28189)
Adds an "FTPS host name verification" section to the ftp component docs that
explains how to enable the check on this line with
ftpClient.endpointCheckingEnabled=true together with trust material, and
notes
that from Camel 4.24 the check is enabled by default with the
hostnameVerification option (#28186).
---
.../camel-ftp/src/main/docs/ftp-component.adoc | 20 ++++++++++++++++++++
1 file changed, 20 insertions(+)
diff --git a/components/camel-ftp/src/main/docs/ftp-component.adoc
b/components/camel-ftp/src/main/docs/ftp-component.adoc
index 8722b4f3c49e..bfeb8d0ae1ca 100644
--- a/components/camel-ftp/src/main/docs/ftp-component.adoc
+++ b/components/camel-ftp/src/main/docs/ftp-component.adoc
@@ -83,6 +83,26 @@ include::partial$component-endpoint-headers.adoc[]
== Usage
+=== FTPS host name verification
+
+The FTPS client that Camel creates does not check that the certificate of the
server matches the host of the endpoint:
+any certificate accepted by the trust manager is accepted, whatever host it
was issued for. To enable the check, set
+`ftpClient.endpointCheckingEnabled=true` on the endpoint. The check is done on
the control connection, during the TLS
+handshake and before login; data connections (`PROT P`) are not checked by
host name. It uses the same rules as an
+HTTPS client, so a connection to an IP address needs a certificate that lists
that address as a subject alternative
+name.
+
+Configure the trust material as well, with `sslContextParameters` or with the
`ftpClient.trustStore.*` options (see
+below), so that only certificates you trust are accepted:
+
+[source,text]
+----
+ftps://[email protected]/inbox?password=secret&sslContextParameters=#sslContextParameters&ftpClient.endpointCheckingEnabled=true
+----
+
+From Camel 4.24 onwards the check is enabled by default and controlled by the
`hostnameVerification` option; on
+earlier versions, use `ftpClient.endpointCheckingEnabled=true` as shown above.
+
=== FTPS component default trust store
When using the `ftpClient.` properties related to SSL with the FTPS
