Skip to content

[backport camel-4.22.x] CAMEL-25964: camel-vertx - VertxHelper does not apply standalone TrustManager from SSLContextParameters #28345

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
davsclaus merged 1 commit into from
Oct 24, 2026
Merged

[backport camel-4.22.x] CAMEL-25964: camel-vertx - VertxHelper does not apply standalone TrustManager from SSLContextParameters #28345

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions components/camel-vertx/camel-vertx-common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,5 +52,17 @@
</exclusion>
</exclusions>
</dependency>

<!-- testing -->
<dependency>
<groupId>org.apache.camel</groupId>
<artifactId>camel-test-junit6</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.assertj</groupId>
<artifactId>assertj-core</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
</project>
375 changes: 188 additions & 187 deletions ...camel-vertx-common/src/main/java/org/apache/camel/component/vertx/common/VertxHelper.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,187 +1,188 @@
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.camel.component.vertx.common;

import java.security.KeyStore;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Locale;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.TrustManagerFactory;

import io.vertx.core.http.ClientAuth;
import io.vertx.core.net.NetServerOptions;
import io.vertx.core.net.TCPSSLOptions;
import io.vertx.core.net.TrustOptions;
import org.apache.camel.CamelContext;
import org.apache.camel.support.jsse.ClientAuthentication;
import org.apache.camel.support.jsse.KeyManagersParameters;
import org.apache.camel.support.jsse.SSLContextParameters;
import org.apache.camel.support.jsse.TrustAllTrustManager;
import org.apache.camel.support.jsse.TrustManagersParameters;

public final class VertxHelper {

private VertxHelper() {
// Utility class
}

/**
* Configures key store and trust store options, the client authentication (of a server) and the cipher suites and
* protocols for the given TCPSSLOptions from the configuration specified on SSLContextParameters
*
* @param camelContext the CamelContext
* @param sslContextParameters the SSL configuration to use for the KeyManagerFactory & TrustManagerFactory
* @param tcpsslOptions the TCPSSLOptions instance to configure
*/
public static void setupSSLOptions(
CamelContext camelContext, SSLContextParameters sslContextParameters, TCPSSLOptions tcpsslOptions)
throws Exception {

if (camelContext == null) {
throw new IllegalArgumentException("camelContext cannot be null");
}

if (sslContextParameters == null) {
throw new IllegalArgumentException("sslContextParameters cannot be null");
}

if (tcpsslOptions == null) {
throw new IllegalArgumentException("tcpsslOptions cannot be null");
}

tcpsslOptions.setSsl(true);

KeyManagerFactory keyManagerFactory = createKeyManagerFactory(camelContext, sslContextParameters);
if (keyManagerFactory != null) {
tcpsslOptions.setKeyCertOptions(new KeyManagerFactoryOptions(keyManagerFactory));
}

TrustManagerFactory trustManagerFactory = createTrustManagerFactory(camelContext, sslContextParameters);
if (trustManagerFactory != null) {
tcpsslOptions.setTrustOptions(new TrustManagerFactoryOptions(trustManagerFactory));
}

if (sslContextParameters.getTrustManagers() != null &&
sslContextParameters.getTrustManagers().getTrustManager() == TrustAllTrustManager.INSTANCE) {
tcpsslOptions.setTrustOptions(TrustOptions.wrap(TrustAllTrustManager.INSTANCE));
}

// client authentication of a server
if (tcpsslOptions instanceof NetServerOptions serverOptions
&& sslContextParameters.getServerParameters() != null
&& sslContextParameters.getServerParameters().getClientAuthentication() != null) {
String value = camelContext.resolvePropertyPlaceholders(
sslContextParameters.getServerParameters().getClientAuthentication());
ClientAuthentication clientAuthentication = ClientAuthentication.valueOf(value.toUpperCase(Locale.ENGLISH));
serverOptions.setClientAuth(switch (clientAuthentication) {
case REQUIRE -> ClientAuth.REQUIRED;
case WANT -> ClientAuth.REQUEST;
case NONE -> ClientAuth.NONE;
});
}

// the cipher suites and protocols (when configured) as computed by the SSLContextParameters
// (such as from the include and exclude filters)
boolean cipherSuites = sslContextParameters.getCipherSuites() != null
|| sslContextParameters.getCipherSuitesFilter() != null;
boolean protocols = sslContextParameters.getSecureSocketProtocols() != null
|| sslContextParameters.getSecureSocketProtocolsFilter() != null;
if (cipherSuites || protocols) {
SSLEngine engine = sslContextParameters.createSSLContext(camelContext).createSSLEngine();
if (cipherSuites) {
for (String suite : engine.getEnabledCipherSuites()) {
tcpsslOptions.addEnabledCipherSuite(suite);
}
}
if (protocols) {
tcpsslOptions.setEnabledSecureTransportProtocols(new LinkedHashSet<>(List.of(engine.getEnabledProtocols())));
}
}
}

private static KeyManagerFactory createKeyManagerFactory(
CamelContext camelContext, SSLContextParameters sslContextParameters)
throws Exception {
final KeyManagersParameters keyManagers = sslContextParameters.getKeyManagers();
if (keyManagers == null) {
return null;
}
keyManagers.setCamelContext(camelContext);
if (keyManagers.getKeyStore() != null) {
keyManagers.getKeyStore().setCamelContext(camelContext);
}

String kmfAlgorithm = camelContext.resolvePropertyPlaceholders(keyManagers.getAlgorithm());
if (kmfAlgorithm == null) {
kmfAlgorithm = KeyManagerFactory.getDefaultAlgorithm();
}

KeyManagerFactory kmf;
if (keyManagers.getProvider() == null) {
kmf = KeyManagerFactory.getInstance(kmfAlgorithm);
} else {
kmf = KeyManagerFactory.getInstance(kmfAlgorithm,
camelContext.resolvePropertyPlaceholders(keyManagers.getProvider()));
}

char[] kmfPassword = null;
if (keyManagers.getKeyPassword() != null) {
kmfPassword = camelContext.resolvePropertyPlaceholders(keyManagers.getKeyPassword()).toCharArray();
}

KeyStore ks = keyManagers.getKeyStore() == null ? null : keyManagers.getKeyStore().createKeyStore();

kmf.init(ks, kmfPassword);
return kmf;
}

private static TrustManagerFactory createTrustManagerFactory(
CamelContext camelContext, SSLContextParameters sslContextParameters)
throws Exception {
final TrustManagersParameters trustManagers = sslContextParameters.getTrustManagers();
if (trustManagers == null) {
return null;
}
trustManagers.setCamelContext(camelContext);
if (trustManagers.getKeyStore() != null) {
trustManagers.getKeyStore().setCamelContext(camelContext);
}

TrustManagerFactory tmf = null;

if (trustManagers.getKeyStore() != null) {
String tmfAlgorithm = camelContext.resolvePropertyPlaceholders(trustManagers.getAlgorithm());
if (tmfAlgorithm == null) {
tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
}

if (trustManagers.getProvider() == null) {
tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
} else {
tmf = TrustManagerFactory.getInstance(tmfAlgorithm,
camelContext.resolvePropertyPlaceholders(trustManagers.getProvider()));
}

KeyStore ks = trustManagers.getKeyStore() == null ? null : trustManagers.getKeyStore().createKeyStore();
tmf.init(ks);
}
return tmf;
}
}
/*
* Licensed to the Apache Software Foundation (ASF) under one or more
* contributor license agreements. See the NOTICE file distributed with
* this work for additional information regarding copyright ownership.
* The ASF licenses this file to You under the Apache License, Version 2.0
* (the "License"); you may not use this file except in compliance with
* the License. You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.apache.camel.component.vertx.common;

import java.security.KeyStore;
import java.util.LinkedHashSet;
import java.util.List;
import java.util.Locale;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLEngine;
import javax.net.ssl.TrustManager;
import javax.net.ssl.TrustManagerFactory;

import io.vertx.core.http.ClientAuth;
import io.vertx.core.net.NetServerOptions;
import io.vertx.core.net.TCPSSLOptions;
import io.vertx.core.net.TrustOptions;
import org.apache.camel.CamelContext;
import org.apache.camel.support.jsse.ClientAuthentication;
import org.apache.camel.support.jsse.KeyManagersParameters;
import org.apache.camel.support.jsse.SSLContextParameters;
import org.apache.camel.support.jsse.TrustManagersParameters;

public final class VertxHelper {

private VertxHelper() {
// Utility class
}

/**
* Configures key store and trust store options, the client authentication (of a server) and the cipher suites and
* protocols for the given TCPSSLOptions from the configuration specified on SSLContextParameters
*
* @param camelContext the CamelContext
* @param sslContextParameters the SSL configuration to use for the KeyManagerFactory & TrustManagerFactory
* @param tcpsslOptions the TCPSSLOptions instance to configure
*/
public static void setupSSLOptions(
CamelContext camelContext, SSLContextParameters sslContextParameters, TCPSSLOptions tcpsslOptions)
throws Exception {

if (camelContext == null) {
throw new IllegalArgumentException("camelContext cannot be null");
}

if (sslContextParameters == null) {
throw new IllegalArgumentException("sslContextParameters cannot be null");
}

if (tcpsslOptions == null) {
throw new IllegalArgumentException("tcpsslOptions cannot be null");
}

tcpsslOptions.setSsl(true);

KeyManagerFactory keyManagerFactory = createKeyManagerFactory(camelContext, sslContextParameters);
if (keyManagerFactory != null) {
tcpsslOptions.setKeyCertOptions(new KeyManagerFactoryOptions(keyManagerFactory));
}

TrustManager trustManager = sslContextParameters.getTrustManagers() != null
? sslContextParameters.getTrustManagers().getTrustManager() : null;
if (trustManager != null) {
tcpsslOptions.setTrustOptions(TrustOptions.wrap(trustManager));
} else {
TrustManagerFactory trustManagerFactory = createTrustManagerFactory(camelContext, sslContextParameters);
if (trustManagerFactory != null) {
tcpsslOptions.setTrustOptions(new TrustManagerFactoryOptions(trustManagerFactory));
}
}

// client authentication of a server
if (tcpsslOptions instanceof NetServerOptions serverOptions
&& sslContextParameters.getServerParameters() != null
&& sslContextParameters.getServerParameters().getClientAuthentication() != null) {
String value = camelContext.resolvePropertyPlaceholders(
sslContextParameters.getServerParameters().getClientAuthentication());
ClientAuthentication clientAuthentication = ClientAuthentication.valueOf(value.toUpperCase(Locale.ENGLISH));
serverOptions.setClientAuth(switch (clientAuthentication) {
case REQUIRE -> ClientAuth.REQUIRED;
case WANT -> ClientAuth.REQUEST;
case NONE -> ClientAuth.NONE;
});
}

// the cipher suites and protocols (when configured) as computed by the SSLContextParameters
// (such as from the include and exclude filters)
boolean cipherSuites = sslContextParameters.getCipherSuites() != null
|| sslContextParameters.getCipherSuitesFilter() != null;
boolean protocols = sslContextParameters.getSecureSocketProtocols() != null
|| sslContextParameters.getSecureSocketProtocolsFilter() != null;
if (cipherSuites || protocols) {
SSLEngine engine = sslContextParameters.createSSLContext(camelContext).createSSLEngine();
if (cipherSuites) {
for (String suite : engine.getEnabledCipherSuites()) {
tcpsslOptions.addEnabledCipherSuite(suite);
}
}
if (protocols) {
tcpsslOptions.setEnabledSecureTransportProtocols(new LinkedHashSet<>(List.of(engine.getEnabledProtocols())));
}
}
}

private static KeyManagerFactory createKeyManagerFactory(
CamelContext camelContext, SSLContextParameters sslContextParameters)
throws Exception {
final KeyManagersParameters keyManagers = sslContextParameters.getKeyManagers();
if (keyManagers == null) {
return null;
}
keyManagers.setCamelContext(camelContext);
if (keyManagers.getKeyStore() != null) {
keyManagers.getKeyStore().setCamelContext(camelContext);
}

String kmfAlgorithm = camelContext.resolvePropertyPlaceholders(keyManagers.getAlgorithm());
if (kmfAlgorithm == null) {
kmfAlgorithm = KeyManagerFactory.getDefaultAlgorithm();
}

KeyManagerFactory kmf;
if (keyManagers.getProvider() == null) {
kmf = KeyManagerFactory.getInstance(kmfAlgorithm);
} else {
kmf = KeyManagerFactory.getInstance(kmfAlgorithm,
camelContext.resolvePropertyPlaceholders(keyManagers.getProvider()));
}

char[] kmfPassword = null;
if (keyManagers.getKeyPassword() != null) {
kmfPassword = camelContext.resolvePropertyPlaceholders(keyManagers.getKeyPassword()).toCharArray();
}

KeyStore ks = keyManagers.getKeyStore() == null ? null : keyManagers.getKeyStore().createKeyStore();

kmf.init(ks, kmfPassword);
return kmf;
}

private static TrustManagerFactory createTrustManagerFactory(
CamelContext camelContext, SSLContextParameters sslContextParameters)
throws Exception {
final TrustManagersParameters trustManagers = sslContextParameters.getTrustManagers();
if (trustManagers == null) {
return null;
}
trustManagers.setCamelContext(camelContext);
if (trustManagers.getKeyStore() != null) {
trustManagers.getKeyStore().setCamelContext(camelContext);
}

TrustManagerFactory tmf = null;

if (trustManagers.getKeyStore() != null) {
String tmfAlgorithm = camelContext.resolvePropertyPlaceholders(trustManagers.getAlgorithm());
if (tmfAlgorithm == null) {
tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm();
}

if (trustManagers.getProvider() == null) {
tmf = TrustManagerFactory.getInstance(tmfAlgorithm);
} else {
tmf = TrustManagerFactory.getInstance(tmfAlgorithm,
camelContext.resolvePropertyPlaceholders(trustManagers.getProvider()));
}

KeyStore ks = trustManagers.getKeyStore() == null ? null : trustManagers.getKeyStore().createKeyStore();
tmf.init(ks);
}
return tmf;
}
}
Loading
Loading