davsclaus opened a new pull request, #28871: URL: https://github.com/apache/camel/pull/28871
## Description Fixes [CAMEL-25674](https://issues.apache.org/jira/browse/CAMEL-25674). With `hostnameVerification=true`, `HttpServerInitializerFactory` set `endpointIdentificationAlgorithm=HTTPS` on the **server** TLS engine. The JDK does not support host name verification on that side of a handshake: - a client that presents a certificate fails the handshake with `CertificateException: Endpoint Identification Algorithm HTTPS is not supported on the server side`, so mTLS (`needClientAuth=true`) cannot work at all; - a client that presents no certificate is not checked. The line never verified anything. This PR removes it, the same fix CAMEL-25649 (#27820) made for `camel-netty`'s `DefaultServerInitializerFactory`. `HttpServerSharedInitializerFactory` never applied the option, so shared-server consumers already behaved this way. The producer side (`HttpClientInitializerFactory`) is unchanged and still verifies the host. ## Changes - `HttpServerInitializerFactory`: no longer applies `hostnameVerification` to the server engine. - `NettyHttpSSLServerHostnameVerificationTest` (new): - an mTLS consumer with `hostnameVerification=true` accepts a trusted client certificate. This **fails before the fix** with the JDK error above. - the same consumer still rejects a client without a certificate, so the first test does not pass because client auth was dropped. - the producer with `hostnameVerification=true` still rejects a certificate that does not match the host (`127.0.0.1` vs `DNS:localhost`). - Docs: a new "Verifying the host name of the server" section in `netty-http-component.adoc` (and its catalog copy) says the option is producer-only. - Upgrade guide 4.24: a note next to the existing `camel-netty` one. ## Testing - `NettyHttpSSL*Test`: 7 tests, all passing; the new mTLS test fails on `main`. - I didn't run the full `camel-netty-http` suite locally. CI runs it. _Claude Code on behalf of davsclaus_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
