pmaripini-salesforce opened a new pull request, #465: URL: https://github.com/apache/qpid-broker-j/pull/465
JIRA: https://issues.apache.org/jira/browse/QPID-8773 ## Summary This is the first, smaller part of #464, split out so that the SPI types can be reviewed on their own. It adds the `org.apache.qpid.server.security.certificate` package to broker-core. Nothing uses it yet, so the broker's behaviour does not change and broker-core still depends on Bouncy Castle. #464 stays open as the complete change. Once this PR is merged, #464 will be rebased onto it so that only the generator plugin and the broker wiring remain. ## Changes - `CertificateGeneratorFactory extends Pluggable`: has a no-argument constructor without side effects. `create()` returns a `CertificateGenerator` and may throw `GeneralSecurityException`. - `CertificateGenerator`: `GeneratedCertificate generate(CertificateRequest)`. Its javadoc defines the certificate every generator must produce: - X.509 v3, DER encoded, and parseable by the JVM's `CertificateFactory`. - Self-signed, using the request's subject and validity. - A positive serial number of at most 20 octets. - A critical basic constraints extension marking it as an end entity. - A non-critical subject alternative name extension, added only when there are names or addresses. The javadoc also says which unchecked provider failures are reported as `GeneralSecurityException`. Implementations must not register security providers, and should use default JCA provider selection. - `CertificateRequest`: immutable, and built with `CertificateRequest.builder()`. - The validity is truncated to whole seconds, the precision X.509 stores, and the start must be before the end. - The subject must not be empty, and the key length must be positive. - DNS names that are not valid host names, such as textual IP addresses, are left out (logged at debug), so every generator sees the same names. - `GeneratedCertificate`: a record holding the private key and the certificate. Its `toString()` leaves out the private key. - `AbstractCertificateGeneratorContractTest`: the behaviour expected of every generator, for implementations to extend. It covers RSA and EC keys and requested key lengths, self-signing, validity (including dates after 2049), basic constraints, subject alternative names (including scoped IPv6 addresses), serial numbers, error reporting, and that the generator does not register security providers. No implementation is part of this PR; the Bouncy Castle generator in #464 runs it. - Unit tests for `CertificateRequest` and `GeneratedCertificate`. ## Testing `mvn -pl broker-core -am verify -Dtest='CertificateRequestTest,GeneratedCertificateTest'` against `main`: 12 tests, all passing. The contract test passes for the Bouncy Castle generator in #464. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
