[
https://issues.apache.org/jira/browse/QPID-8776?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Partha Sarathy Maripini updated QPID-8776:
------------------------------------------
Description:
Add the module qpid-broker-plugins-certificate-generator-bouncycastle (type
BouncyCastle), containing the previous SSLUtil generation code behind the SPI.
It produces the same certificate as before and accepts the same signature
algorithm names.
* The plugin does not create or register a security provider; keys, signatures
and certificate parsing use default JCA provider selection.
* Bouncy Castle is a provided dependency, so the plugin uses whichever
compatible bcpkix is on the classpath.
* qpid-broker, and so the distribution, includes the plugin plus bcprov-jdk18on
and bcpkix-jdk18on.
* bcprov-jdk18on and bcpkix-jdk18on are removed from broker-core, and an
enforcer rule bans org.bouncycastle:* from broker-core outside test scope.
was:
*Background:*
To decouple core broker logic from specific cryptographic libraries, the
existing standard Bouncy Castle certificate generation logic must be moved to
an isolated plugin.
*Tasks:*
1. Create a plugin module `qpid-broker-plugins-cert-generator-bc` (or place in
the standard security plugin directory).
2. Implement `CertificateGeneratorProvider` using standard Bouncy Castle
libraries (`bcprov-jdk*`).
3. Register the service provider in
`META-INF/services/org.apache.qpid.server.security.cert.CertificateGeneratorProvider`.
*Acceptance Criteria:*
- Non-FIPS self-signed certificate generation functions as default behavior.
- Core build succeeds when loading the default plugin module.
> [Broker-J] Extract the Bouncy Castle certificate generator into a plugin
> module
> -------------------------------------------------------------------------------
>
> Key: QPID-8776
> URL: https://issues.apache.org/jira/browse/QPID-8776
> Project: Qpid
> Issue Type: Sub-task
> Components: Broker-J
> Reporter: Partha Sarathy Maripini
> Priority: Major
>
> Add the module qpid-broker-plugins-certificate-generator-bouncycastle (type
> BouncyCastle), containing the previous SSLUtil generation code behind the
> SPI. It produces the same certificate as before and accepts the same
> signature algorithm names.
> * The plugin does not create or register a security provider; keys,
> signatures and certificate parsing use default JCA provider selection.
> * Bouncy Castle is a provided dependency, so the plugin uses whichever
> compatible bcpkix is on the classpath.
> * qpid-broker, and so the distribution, includes the plugin plus
> bcprov-jdk18on and bcpkix-jdk18on.
> * bcprov-jdk18on and bcpkix-jdk18on are removed from broker-core, and an
> enforcer rule bans org.bouncycastle:* from broker-core outside test scope.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
