[
https://issues.apache.org/jira/browse/CAMEL-24443?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen resolved CAMEL-24443.
---------------------------------
Resolution: Fixed
> camel-knative-http - enabling SSL without a truststore falls back to trusting
> all certificates
> ----------------------------------------------------------------------------------------------
>
> Key: CAMEL-24443
> URL: https://issues.apache.org/jira/browse/CAMEL-24443
> Project: Camel
> Issue Type: Bug
> Components: camel-knative-http
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{KnativeSslClientOptions.configureOptions()}} ends with:
> {code:java}
> if (truststorePath.isPresent()) {
> setTruststorePath(truststorePath.get());
> setTruststorePassword(truststorePassword);
> } else if (trustCertPath.isPresent()) {
> setTrustCertPath(trustCertPath.get().split(","));
> } else {
> trustOptions = TrustAllOptions.INSTANCE;
> setTrustOptions(trustOptions);
> }
> {code}
> So {{camel.knative.client.ssl.enabled=true}} with no truststore or trust-cert
> path configured installs {{TrustAllOptions.INSTANCE}}, an
> {{X509ExtendedTrustManager}} that accepts every certificate. No option named
> {{trustAll}} is involved - this is what enabling SSL alone produces.
> That is the opposite of the convention elsewhere in Camel:
> {{SSLContextParameters}} and the JSSE utility fall back to the JVM default
> trust anchors when no truststore is configured. Hostname verification in the
> same method already defaults to {{true}}, so the trust decision is the
> outlier. {{KnativeOidcClientOptions}} extends this class, so bearer tokens
> ride the same connection.
> Proposal: fall back to the JVM default trust store, and require an explicit
> opt-in option for trust-all. Needs an upgrade-guide entry for deployments
> that relied on the fallback.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
