[ 
https://issues.apache.org/jira/browse/CAMEL-14527?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17035319#comment-17035319
 ] 

Jiri Ondrusek commented on CAMEL-14527:
---------------------------------------

[~catshout]

Working configuration, where sslContextParameters are defined in one bundle. 
Second blueprint is in second bundle:

{code}
<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"; 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; 
xsi:schemaLocation="http://www.osgi.org/xmlns/blueprint/v1.0.0 
https://www.osgi.org/xmlns/blueprint/v1.0.0/blueprint.xsd";>

 <sslContextParameters id="sslContextParameters" 
xmlns="http://camel.apache.org/schema/blueprint";>
   <secureSocketProtocolsFilter>
     <include>TLSv1.2</include>
     <include>TLSv1.1</include>
   </secureSocketProtocolsFilter>
   <cipherSuitesFilter>
     <include>.*</include>
     <exclude/>
   </cipherSuitesFilter>
   <keyManagers keyPassword="test">
     <keyStore resource="keystore2" password="testtest"/>
   </keyManagers>
      <trustManagers>
     <keyStore resource="server.truststore" password="testtest"/>
   </trustManagers>
 </sslContextParameters>

 <camelContext id="WEBISP001" xmlns="http://camel.apache.org/schema/blueprint";>
   <route id="WEBISP001">
     <from 
uri="jetty:https://0.0.0.0:8444/hello?sslContextParameters=#sslContextParameters";
  />
     <log message="hello request body: ${in.body}" />
   </route>
 </camelContext>

 <service ref="sslContextParameters" auto-export="all-classes" />
 
</blueprint>
{code}

and 

{code}
<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"; 
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; 
xsi:schemaLocation="http://www.osgi.org/xmlns/blueprint/v1.0.0 
https://www.osgi.org/xmlns/blueprint/v1.0.0/blueprint.xsd";
           
xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.0.0";>
 
    <reference id="sslContextParameters" 
interface="org.apache.camel.support.jsse.SSLContextParameters" 
ext:proxy-method="classes"/>
     
     
 <camelContext id="WEBISP002" xmlns="http://camel.apache.org/schema/blueprint";>
   <route id="WEBISP002">
     <from 
uri="jetty:https://0.0.0.0:8444/hello2?sslContextParameters=#sslContextParameters";
  />
     <log message="hello request body2: ${in.body}" />
   </route>
 </camelContext>
</blueprint>
{code}

Could you please verify it in your environment?

> camel-jetty HTTPS consumer still fails with handshake failure
> -------------------------------------------------------------
>
>                 Key: CAMEL-14527
>                 URL: https://issues.apache.org/jira/browse/CAMEL-14527
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-jetty
>    Affects Versions: 3.0.1
>            Reporter: Gerald Kallas
>            Assignee: Jiri Ondrusek
>            Priority: Major
>
> After several research I did create the following Blueprint DSL route that 
> still fails with a TLS handshake failure.
> {code:java}
> <blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0";<blueprint 
> xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"; 
> xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"; 
> xsi:schemaLocation="http://www.osgi.org/xmlns/blueprint/v1.0.0 
> https://www.osgi.org/xmlns/blueprint/v1.0.0/blueprint.xsd";>
>  <sslContextParameters id="sslContextParameters" 
> xmlns="http://camel.apache.org/schema/blueprint";>
>    <secureSocketProtocolsFilter>
>      <include>TLSv1.2</include>
>      <include>TLSv1.1</include>
>    </secureSocketProtocolsFilter>
>    <cipherSuitesFilter>
>      <include>.*</include>
>      <exclude/>
>    </cipherSuitesFilter>
>    <keyManagers keyPassword="xxxxx">
>      <keyStore resource="etc/truststore.jks" password="xxxxx"/>
>    </keyManagers>
>    <trustManagers>
>      <keyStore resource="etc/keystore.p12" password="xxxxx"/>
>    </trustManagers>
>  </sslContextParameters>
>  <camelContext id="WEBISP001" 
> xmlns="http://camel.apache.org/schema/blueprint";>
>    <route id="WEBISP001">
>      <from 
> uri="jetty:https://0.0.0.0:8444/hello?sslContextParameters=sslContextParameters";
>   />
>      <log message="hello request body: ${in.body}" />
>    </route>
>  </camelContext>
> </blueprint>
> {code}
> This is the deployment log
> {code:java}
> 2020-02-08T20:31:49,784 | INFO  | fileinstall-/opt/apache-karaf-4.2.7/deploy 
> | BlueprintContainerImpl           | 80 - org.apache.aries.blueprint.core - 
> 1.10.2 | Blueprint bundle WEBISP001.xml/0.0.0 has been started
> 2020-02-08T20:31:49,786 | INFO  | Blueprint Event Dispatcher: 1 | 
> BlueprintCamelContext            | 88 - org.apache.camel.camel-api - 3.0.1 | 
> Attempting to start CamelContext: WEBISP001
> 2020-02-08T20:31:49,789 | INFO  | Blueprint Event Dispatcher: 1 | 
> BlueprintCamelContext            | 88 - org.apache.camel.camel-api - 3.0.1 | 
> Apache Camel 3.0.1 (CamelContext: WEBISP001) is starting
> 2020-02-08T20:31:49,791 | INFO  | Blueprint Event Dispatcher: 1 | 
> JmxManagementStrategy            | 88 - org.apache.camel.camel-api - 3.0.1 | 
> JMX is enabled
> 2020-02-08T20:31:49,877 | INFO  | Blueprint Event Dispatcher: 1 | 
> HttpComponent                    | 88 - org.apache.camel.camel-api - 3.0.1 | 
> Created ClientConnectionManager 
> org.apache.http.impl.conn.PoolingHttpClientConnectionManager@12fc7e57
> 2020-02-08T20:31:49,881 | INFO  | Blueprint Event Dispatcher: 1 | 
> BlueprintCamelContext            | 88 - org.apache.camel.camel-api - 3.0.1 | 
> StreamCaching is not in use. If using streams then its recommended to enable 
> stream caching. See more details at 
> http://camel.apache.org/stream-caching.html
> 2020-02-08T20:31:49,896 | INFO  | Blueprint Event Dispatcher: 1 | 
> SSLContextParameters             | 88 - org.apache.camel.camel-api - 3.0.1 | 
> Available providers: SUN version 1.8.
> 2020-02-08T20:31:49,906 | INFO  | Blueprint Event Dispatcher: 1 | 
> JettyHttpComponent9              | 112 - org.apache.camel.camel-jetty - 3.0.1 
> | Connector on port: 8444 is using includeCipherSuites: [.*] 
> excludeCipherSuites: [] includeProtocols: [TLSv1.3, TLSv1.2, TLSv1.1] 
> excludeProtocols: [SSL, SSLv2, SSLv2Hello, SSLv3]
> 2020-02-08T20:31:49,907 | INFO  | Blueprint Event Dispatcher: 1 | Server      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | 
> jetty-9.4.20.v20190813; built: 2019-08-13T21:28:18.144Z; git: 
> 84700530e645e812b336747464d6fbbf370c9a20; jvm 1.8.0_242-b08
> 2020-02-08T20:31:49,908 | INFO  | Blueprint Event Dispatcher: 1 | 
> ContextHandler                   | 217 - org.eclipse.jetty.util - 
> 9.4.20.v20190813 | Started 
> o.e.j.s.ServletContextHandler@4d63dc0b{/,null,AVAILABLE}
> 2020-02-08T20:31:49,915 | INFO  | Blueprint Event Dispatcher: 1 | 
> SslContextFactory                | 217 - org.eclipse.jetty.util - 
> 9.4.20.v20190813 | Protocol TLSv1.3 not supported in [SSLv2Hello, SSLv3, 
> TLSv1, TLSv1.1, TLSv1.2]
> 2020-02-08T20:31:49,915 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_RSA_WITH_AES_256_CBC_SHA256 enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,916 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,916 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,917 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_RSA_WITH_AES_256_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,917 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_RSA_WITH_AES_256_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,917 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,918 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_ECDH_RSA_WITH_AES_256_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,918 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_DHE_RSA_WITH_AES_256_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,919 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_DHE_DSS_WITH_AES_256_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,919 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_RSA_WITH_AES_128_CBC_SHA256 enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,921 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,922 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,923 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_RSA_WITH_AES_128_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,924 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_RSA_WITH_AES_128_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,925 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,926 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_ECDH_RSA_WITH_AES_128_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,927 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_DHE_RSA_WITH_AES_128_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,927 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_DHE_DSS_WITH_AES_128_CBC_SHA enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,928 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_RSA_WITH_AES_256_GCM_SHA384 enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,929 | WARN  | Blueprint Event Dispatcher: 1 | config      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | Weak 
> cipher suite TLS_RSA_WITH_AES_128_GCM_SHA256 enabled for 
> SslContextFactory@6234ffd1[provider=null,keyStore=null,trustStore=null]
> 2020-02-08T20:31:49,930 | INFO  | Blueprint Event Dispatcher: 1 | 
> AbstractConnector                | 217 - org.eclipse.jetty.util - 
> 9.4.20.v20190813 | Started ServerConnector@11e4bb7f{ssl,[ssl, 
> http/1.1]}{0.0.0.0:8444}
> 2020-02-08T20:31:49,931 | INFO  | Blueprint Event Dispatcher: 1 | Server      
>                      | 217 - org.eclipse.jetty.util - 9.4.20.v20190813 | 
> Started @1786570ms
> 2020-02-08T20:31:49,932 | INFO  | Blueprint Event Dispatcher: 1 | 
> BlueprintCamelContext            | 88 - org.apache.camel.camel-api - 3.0.1 | 
> Route: WEBISP001 started and consuming from: jetty:https://0.0.0.0:8444/hello
> 2020-02-08T20:31:49,933 | INFO  | Blueprint Event Dispatcher: 1 | 
> BlueprintCamelContext            | 88 - org.apache.camel.camel-api - 3.0.1 | 
> Total 1 routes, of which 1 are started
> 2020-02-08T20:31:49,933 | INFO  | Blueprint Event Dispatcher: 1 | 
> BlueprintCamelContext            | 88 - org.apache.camel.camel-api - 3.0.1 | 
> Apache Camel 3.0.1 (CamelContext: WEBISP001) started in 0.145 seconds
> 2020-02-08T20:31:49,987 | INFO  | fileinstall-/opt/apache-karaf-4.2.7/deploy 
> | fileinstall                      | 10 - org.apache.felix.fileinstall - 
> 3.6.4 | Started bundle: 
> blueprint:file:/opt/apache-karaf-4.2.7/deploy/WEBISP001.xml
> {code}
> The request to the endpoint still fails with
> {code:java}
> curl -vvv --insecure --location --request POST 'https://host:8444/hello'  
> --data-raw 'Hello World!'
> Note: Unnecessary use of -X or --request, POST is already inferred.
> *   Trying 10.0.0.147...
> * TCP_NODELAY set
> * Connected to host (10.0.0.147) port 8444 (#0)
> * ALPN, offering h2
> * ALPN, offering http/1.1
> * successfully set certificate verify locations:
> *   CAfile: /etc/pki/tls/certs/ca-bundle.crt
>   CApath: none
> * TLSv1.3 (OUT), TLS handshake, Client hello (1):
> * TLSv1.3 (IN), TLS alert, handshake failure (552):
> * error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake failure
> * Closing connection 0
> curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handshake 
> failure{code}



--
This message was sent by Atlassian Jira
(v8.3.4#803005)

Reply via email to