You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@cxf.apache.org by "Julius Davies (JIRA)" <ji...@apache.org> on 2008/04/25 07:53:57 UTC
[jira] Created: (CXF-1549) Let TLSClientParameters take an
SSLSocketFactory
Let TLSClientParameters take an SSLSocketFactory
------------------------------------------------
Key: CXF-1549
URL: https://issues.apache.org/jira/browse/CXF-1549
Project: CXF
Issue Type: Improvement
Components: Transports
Reporter: Julius Davies
Priority: Trivial
Let TLSClientParameters take an SSLSocketFactory so that people using not-yet-commons-ssl.jar, or others who know what they're doing, can set their own SSLSocketFactory for https transport.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (CXF-1549) Let TLSClientParameters take an
SSLSocketFactory
Posted by "Glen Mazza (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/CXF-1549?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12592338#action_12592338 ]
Glen Mazza commented on CXF-1549:
---------------------------------
I'm not so sure about this. TLSClientParameters abstracts the SSLSocketFactory--it already provides a window for its customization. Wouldn't allowing you to set the SSLSocketFactory would conflict with the other settings of TLSClientParameters?
> Let TLSClientParameters take an SSLSocketFactory
> ------------------------------------------------
>
> Key: CXF-1549
> URL: https://issues.apache.org/jira/browse/CXF-1549
> Project: CXF
> Issue Type: Improvement
> Components: Transports
> Reporter: Julius Davies
> Priority: Trivial
> Attachments: cxf-1549-1st-draft.patch
>
>
> Let TLSClientParameters take an SSLSocketFactory so that people using not-yet-commons-ssl.jar, or others who know what they're doing, can set their own SSLSocketFactory for https transport.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Resolved: (CXF-1549) Let TLSClientParameters take an
SSLSocketFactory
Posted by "Daniel Kulp (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/CXF-1549?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Daniel Kulp resolved CXF-1549.
------------------------------
Resolution: Fixed
Fix Version/s: 2.1.5
Assignee: Daniel Kulp
> Let TLSClientParameters take an SSLSocketFactory
> ------------------------------------------------
>
> Key: CXF-1549
> URL: https://issues.apache.org/jira/browse/CXF-1549
> Project: CXF
> Issue Type: Improvement
> Components: Transports
> Reporter: Julius Davies
> Assignee: Daniel Kulp
> Priority: Trivial
> Fix For: 2.1.5
>
> Attachments: cxf-1549-1st-draft.patch
>
>
> Let TLSClientParameters take an SSLSocketFactory so that people using not-yet-commons-ssl.jar, or others who know what they're doing, can set their own SSLSocketFactory for https transport.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Commented: (CXF-1549) Let TLSClientParameters take an
SSLSocketFactory
Posted by "Julius Davies (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/CXF-1549?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=12592430#action_12592430 ]
Julius Davies commented on CXF-1549:
------------------------------------
In my opinion the customization of the SSLSocketFactory through not-yet-commons-ssl is superior. Users need to write much less code to customize the SSL as they want it. (In particular, notice how the client cert can come from an OpenSSL style key + cert pair in PEM.)
Here's everything that's currently customizable in not-yet-commons-ssl:
KeyMaterial opensslKey = new KeyMaterial("key.pem", "cert.pem", new char[]{'p','a','s','s'});
KeyMaterial javaKey = new KeyMaterial("keystore.jks", new char[]{'p','a','s','s'});
TrustMaterial trust = new TrustMaterial("another-cert.pem");
SSLClient client = new SSLClient();
// Key and trust so central to SSL:
client.setKeyMaterial(opensslKey);
client.setTrustMaterial(TrustMaterial.CACERTS);
client.addTrustMaterial(trust); // let's trust one additional cert
// Protocol stuff
client.setDefaultProtocol("TLS");
client.setEnabledProtocols(new String[]{"TLSv1", "SSLv3", "SSLv2Hello"});
client.setEnabledCiphers(new String[]{"TLS_RSA_WITH_AES_128_CBC_SHA"});
client.setUseClientMode(true);
client.setNeedClientAuth(false); // For weird situation where SSLServer initiates the connection.
// How easy-going are we?
client.setCheckCRL(true);
client.setCheckExpiry(true);
client.setCheckHostname(true);
client.setHostnameVerifier(HostnameVerifier.STRICT_IE6);
// Timeouts
client.setConnectTimeout(10000);
client.setSoTimeout(30000);
return (javax.net.ssl.SSLSocketFactory) client;
By accepting this patch, users could now go this route. Or they can still decorate the SSL using the standard CXF way, but this does give users the choice, and ultimately a lot more flexibility if they need it.
In a future version we're going to add:
client.setCheckOCSP(true);
> Let TLSClientParameters take an SSLSocketFactory
> ------------------------------------------------
>
> Key: CXF-1549
> URL: https://issues.apache.org/jira/browse/CXF-1549
> Project: CXF
> Issue Type: Improvement
> Components: Transports
> Reporter: Julius Davies
> Priority: Trivial
> Attachments: cxf-1549-1st-draft.patch
>
>
> Let TLSClientParameters take an SSLSocketFactory so that people using not-yet-commons-ssl.jar, or others who know what they're doing, can set their own SSLSocketFactory for https transport.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.
[jira] Updated: (CXF-1549) Let TLSClientParameters take an
SSLSocketFactory
Posted by "Julius Davies (JIRA)" <ji...@apache.org>.
[ https://issues.apache.org/jira/browse/CXF-1549?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Julius Davies updated CXF-1549:
-------------------------------
Attachment: cxf-1549-1st-draft.patch
Here's what I'm planning. Obviously needs unit tests and even a run through in a real environment, but I thought I'd upload it to see what people think of the approach.
> Let TLSClientParameters take an SSLSocketFactory
> ------------------------------------------------
>
> Key: CXF-1549
> URL: https://issues.apache.org/jira/browse/CXF-1549
> Project: CXF
> Issue Type: Improvement
> Components: Transports
> Reporter: Julius Davies
> Priority: Trivial
> Attachments: cxf-1549-1st-draft.patch
>
>
> Let TLSClientParameters take an SSLSocketFactory so that people using not-yet-commons-ssl.jar, or others who know what they're doing, can set their own SSLSocketFactory for https transport.
--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.