You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "gnodet (via GitHub)" <gi...@apache.org> on 2026/03/23 13:07:34 UTC
[PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
gnodet opened a new pull request, #22194:
URL: https://github.com/apache/camel/pull/22194
## Summary
- Move SSL configuration (`camel.ssl.*`) before HTTP server configuration so global SSL context is available when the server is created
- Auto-enable `useGlobalSslContextParameters` on both HTTP server and management server when `camel.ssl.enabled=true`, removing the need to set it separately
- Generate a self-signed certificate when SSL is enabled but no keystore is configured, enabling HTTPS with a single property for development use
### Before (4+ properties needed)
```properties
camel.ssl.enabled=true
camel.ssl.keyStore=file:keystore.jks
camel.ssl.keystorePassword=changeit
camel.server.useGlobalSslContextParameters=true
```
### After — minimal for development (1 property)
```properties
camel.ssl.enabled=true
```
### After — with keystore for production (3 properties)
```properties
camel.ssl.enabled=true
camel.ssl.keyStore=file:keystore.jks
camel.ssl.keystorePassword=changeit
```
## Test plan
- [x] Added `testMainSSLSelfSigned` — verifies self-signed cert is generated and a valid SSLContext can be created
- [x] Added `testMainSSLSelfSignedFluent` — same test using fluent API
- [x] Added `testSelfSignedCertificateGenerator` — unit test for the generator utility
- [x] All 15 existing SSL tests still pass
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus merged PR #22194:
URL: https://github.com/apache/camel/pull/22194
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #22194:
URL: https://github.com/apache/camel/pull/22194#issuecomment-4110633257
<!-- ci-tested-modules -->
:test_tube: **CI tested the following changed modules:**
- `core/camel-main`
> :information_source: Dependent modules were not tested because the total number of affected modules exceeded the threshold (50). Use the `test-dependents` label to force testing all dependents.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "squakez (via GitHub)" <gi...@apache.org>.
squakez commented on code in PR #22194:
URL: https://github.com/apache/camel/pull/22194#discussion_r2993086047
##########
core/camel-main/src/main/java/org/apache/camel/main/SelfSignedCertificateGenerator.java:
##########
@@ -0,0 +1,241 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.main;
+
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.KeyStore;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.SecureRandom;
+import java.security.Signature;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+
+/**
+ * Generates a self-signed certificate for development use. This allows enabling HTTPS with minimal configuration when
+ * no keystore is provided.
+ *
+ * The generated certificate is NOT suitable for production use.
+ */
+final class SelfSignedCertificateGenerator {
+
+ private SelfSignedCertificateGenerator() {
+ }
+
+ /**
+ * Generates a PKCS12 KeyStore containing a self-signed certificate with Subject Alternative Names for localhost and
+ * 127.0.0.1.
+ *
+ * @param password the password for the keystore and key entry
+ * @return a KeyStore containing the self-signed certificate
+ * @throws Exception if certificate generation fails
+ */
+ static KeyStore generateKeyStore(String password) throws Exception {
+ SecureRandom random = new SecureRandom();
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(2048, random);
+ KeyPair keyPair = keyGen.generateKeyPair();
+
+ X509Certificate cert = generateCertificate(keyPair, random);
+
+ KeyStore ks = KeyStore.getInstance("PKCS12");
Review Comment:
This one may fail if security provider is broken or missing. Also, not reliable on FIPS environment or OSGI.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on PR #22194:
URL: https://github.com/apache/camel/pull/22194#issuecomment-4208061548
There is already `trustAllCertificates` option to also make it easier for development mode for HTTPS.
Camel Spring Boot also has a `CamelSSLAutoConfiguration` class that likely need to be updated as well
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #22194:
URL: https://github.com/apache/camel/pull/22194#discussion_r2993622971
##########
core/camel-main/src/main/java/org/apache/camel/main/SelfSignedCertificateGenerator.java:
##########
@@ -0,0 +1,241 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.camel.main;
+
+import java.io.ByteArrayInputStream;
+import java.nio.charset.StandardCharsets;
+import java.security.KeyPair;
+import java.security.KeyPairGenerator;
+import java.security.KeyStore;
+import java.security.PrivateKey;
+import java.security.PublicKey;
+import java.security.SecureRandom;
+import java.security.Signature;
+import java.security.cert.CertificateFactory;
+import java.security.cert.X509Certificate;
+import java.time.ZoneOffset;
+import java.time.ZonedDateTime;
+
+/**
+ * Generates a self-signed certificate for development use. This allows enabling HTTPS with minimal configuration when
+ * no keystore is provided.
+ *
+ * The generated certificate is NOT suitable for production use.
+ */
+final class SelfSignedCertificateGenerator {
+
+ private SelfSignedCertificateGenerator() {
+ }
+
+ /**
+ * Generates a PKCS12 KeyStore containing a self-signed certificate with Subject Alternative Names for localhost and
+ * 127.0.0.1.
+ *
+ * @param password the password for the keystore and key entry
+ * @return a KeyStore containing the self-signed certificate
+ * @throws Exception if certificate generation fails
+ */
+ static KeyStore generateKeyStore(String password) throws Exception {
+ SecureRandom random = new SecureRandom();
+ KeyPairGenerator keyGen = KeyPairGenerator.getInstance("RSA");
+ keyGen.initialize(2048, random);
+ KeyPair keyPair = keyGen.generateKeyPair();
+
+ X509Certificate cert = generateCertificate(keyPair, random);
+
+ KeyStore ks = KeyStore.getInstance("PKCS12");
Review Comment:
PKCS12 is the default keystore type since JDK 9 and is provided by the built-in SunJSSE provider — if it's unavailable, no SSL functionality would work at all. For FIPS environments, self-signed certificates wouldn't be appropriate anyway (FIPS is a production/compliance requirement, selfSigned=true is explicitly for dev use). If generation does fail for any reason, the exception propagates clearly and the context won't start silently without SSL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on PR #22194:
URL: https://github.com/apache/camel/pull/22194#issuecomment-4257604995
LGTM
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #22194:
URL: https://github.com/apache/camel/pull/22194#issuecomment-4110480271
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `build-all`, `build-dependents`, `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #22194:
URL: https://github.com/apache/camel/pull/22194#issuecomment-4128687223
_Claude Code on behalf of Guillaume Nodet_
Thanks for the feedback @squakez! The latest push addresses the concerns raised:
**Self-signed certificate is now explicit opt-in only:**
- Requires `camel.ssl.selfSigned=true` — no auto-generation when keystore is missing
- When SSL is enabled without a keystore or `selfSigned`, a warning is logged and SSL context creation is skipped
- The self-signed generation emits a `WARN` log: "Do NOT use this in production"
**Secret annotations fixed:**
- `camel.ssl.keystorePassword` and `camel.ssl.trustStorePassword` are now marked `secret=true` (was missing)
**Follow-up for broader secret/dev-setting warnings:**
- Created [CAMEL-23250](https://issues.apache.org/jira/browse/CAMEL-23250) to track:
- Warning when plain-text secrets are used in configuration (instead of vault/env refs)
- Flagging development-only settings (`selfSigned`, `trustAllCertificates`) when used in production profiles
- Fixing `PropertiesDevConsole` JSON output which doesn't mask secrets
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22497: Make HTTPS easier for camel.server [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #22194:
URL: https://github.com/apache/camel/pull/22194#issuecomment-4130562200
## Self-Signed Certificate Generation: Framework Comparison
For context on the approach we took with `SelfSignedCertificateGenerator`, here's how other frameworks handle self-signed certificate generation:
### Netty
Uses a **two-tier fallback**:
1. **BouncyCastle** (preferred) — `X509v3CertificateBuilder`, `JcaContentSignerBuilder`, etc.
2. **OpenJDK internal APIs** (fallback) — `sun.security.x509.*` classes (`X509CertInfo`, `X509CertImpl`, `X500Name`, etc.) via reflection
Both have downsides: BouncyCastle is a heavy optional dependency, and `sun.security.x509` classes are internal JDK APIs increasingly restricted by module encapsulation. Netty is currently discussing ([PR #14263](https://github.com/netty/netty/pull/14263)) adding a separate module with **their own DER encoder** — essentially the same approach we took here.
### Vert.x
Delegates entirely to Netty's `SelfSignedCertificate` (wraps `new io.netty.handler.ssl.util.SelfSignedCertificate(fqdn)`).
### Quarkus
Uses **SmallRye Certs** library (`io.smallrye.certs.CertificateGenerator`) which depends on **BouncyCastle** (`BouncyCastleProvider`). Available via CLI: `quarkus tls generate-certificate --self-signed`.
### Our Approach (Camel)
Our `SelfSignedCertificateGenerator` builds the DER-encoded X.509 certificate directly using **standard JDK APIs only** (`KeyPairGenerator`, `Signature`, `CertificateFactory`) — no internal APIs, no BouncyCastle dependency:
- **Lightest approach** — zero extra dependencies
- **Most forward-compatible** — no `sun.security.x509` or `--add-opens` needed
- **Aligned with Netty's direction** — they're moving toward their own DER encoding too
- **Explicit opt-in** — requires `camel.ssl.selfSigned=true`, just like Quarkus requires `--self-signed`
_Claude Code on behalf of Guillaume Nodet_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org