[
https://issues.apache.org/jira/browse/QPID-8778?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Partha Sarathy Maripini updated QPID-8778:
------------------------------------------
Description:
Select the certificate generator when the Broker starts (SystemLauncher), and
otherwise on first use for embedded hosts:
* qpid.security.certificateGenerator set: that type is used; startup fails if
it is unknown or cannot be created.
* Not set, several generators installed: startup fails and asks for the
property.
* Not set, one installed: it is used. If a library it needs is missing,
generation is unavailable and a warning is logged.
* Not set, none installed: generation is unavailable.
A generator type can be disabled with
qpid.plugin.disabled:certificategeneratorfactory.<type>=true. The property is
documented in the System Properties appendix and the Keystores chapter.
was:
*Background:*
Operators need a explicit configuration mechanism to select between standard
and FIPS certificate generators, and the broker must fail safely if the
required provider is unavailable.
*Tasks:*
1. Introduce a system property / context variable (e.g.,
`qpid.cert_generator=BCFIPS`).
2. Update SSLUtil initialization to validate that the requested generator
implementation exists in the service loader.
3. Enforce fail-fast startup behavior with a clear log message if the
explicitly requested generator cannot be loaded.
*Acceptance Criteria:*
- Setting the configuration property selects the matching implementation.
- Specifying an unresolvable generator causes broker startup to halt
immediately with an explanatory error.
> [Broker-J] Add a startup property for certificate generator selection with
> fail-fast handling
> ---------------------------------------------------------------------------------------------
>
> Key: QPID-8778
> URL: https://issues.apache.org/jira/browse/QPID-8778
> Project: Qpid
> Issue Type: Sub-task
> Components: Broker-J
> Reporter: Partha Sarathy Maripini
> Priority: Major
>
> Select the certificate generator when the Broker starts (SystemLauncher), and
> otherwise on first use for embedded hosts:
> * qpid.security.certificateGenerator set: that type is used; startup fails if
> it is unknown or cannot be created.
> * Not set, several generators installed: startup fails and asks for the
> property.
> * Not set, one installed: it is used. If a library it needs is missing,
> generation is unavailable and a warning is logged.
> * Not set, none installed: generation is unavailable.
> A generator type can be disabled with
> qpid.plugin.disabled:certificategeneratorfactory.<type>=true. The property is
> documented in the System Properties appendix and the Keystores chapter.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
