[
https://issues.apache.org/jira/browse/CAMEL-25605?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18127238#comment-18127238
]
Claus Ibsen commented on CAMEL-25605:
-------------------------------------
Merged to main in https://github.com/apache/camel/pull/27770
_Claude Code on behalf of davsclaus_
> camel-mina - Add hostname verification for TLS producer connections
> -------------------------------------------------------------------
>
> Key: CAMEL-25605
> URL: https://issues.apache.org/jira/browse/CAMEL-25605
> Project: Camel
> Issue Type: Improvement
> Components: camel-mina
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.24.0
>
>
> camel-netty has a {{hostnameVerification}} option that sets the {{HTTPS}}
> endpoint identification algorithm on its client {{SSLEngine}}. camel-mina has
> no equivalent: {{MinaProducer}} adds an {{SslFilter}} built from the
> {{SSLContext}} of {{sslContextParameters}} and never sets an endpoint
> identification algorithm on it (MINA 2.2 offers
> {{SslFilter.setEndpointIdentificationAlgorithm}}), and there is no option to
> set one.
> Proposed change:
> * In {{MinaProducer}}, call {{setEndpointIdentificationAlgorithm("HTTPS")}}
> on the client {{SslFilter}} unless the check is turned off.
> * Add a {{hostnameVerification}} option, enabled by default, to turn the
> check off (label {{security}}, {{security = "insecure:ssl"}}, {{insecureValue
> = "false"}}, as in camel-netty). It applies to the producer only.
> * Document it in {{mina-component.adoc}}, and add upgrade guide notes: a
> producer that connects by IP address, or to a server whose certificate does
> not list the configured host name, needs a matching certificate or
> {{hostnameVerification=false}}.
> * Tests: the handshake fails by default when the server certificate does not
> match the configured host, and succeeds with the option off or with a
> matching certificate.
> Same change as CAMEL-25604 for camel-mllp. To be backported to 4.22.x and
> 4.18.x once merged on main.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
