You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "oscerd (via GitHub)" <gi...@apache.org> on 2026/03/12 09:53:36 UTC
[PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
oscerd opened a new pull request, #21951:
URL: https://github.com/apache/camel/pull/21951
…b: Add SSLContextParameters support and fix hardcoded TLS version
Add SSLContextParameters support and fix hardcoded TLS version
- Replace hardcoded SSLContext.getInstance("TLSv1.2") with SSLContext.getInstance("TLS") in SslAwareMongoClient to allow the JVM to negotiate the highest supported TLS version including TLS 1.3 with PQC key exchange
- Implement SSLContextParametersAware on MongoDbComponent to support global SSL context parameters
- Add sslContextParameters endpoint option on MongoDbEndpoint for per-endpoint SSL/TLS configuration via Camel's SSLContextParameters
- When sslContextParameters is set, TLS is automatically enabled on the MongoDB connection with proper SSLContext configuration
Add TLS integration test with test-infra
- Add MongoDBLocalContainerTLSService to test-infra-mongodb that starts a standalone mongod with --tlsMode requireTLS using pre-generated self-signed certificates mounted via classpath resource mapping
- Add MongoDbSslConnectionIT integration test that validates end-to-end TLS connectivity using Camel's SSLContextParameters with a JKS truststore containing the test CA certificate
- Include test certificate resources: CA cert (ca.pem), combined server cert+key (server.pem), and JKS truststore (ca-truststore.jks)
# Description
<!--
- Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
-->
# Target
- [x] I checked that the commit is targeting the correct branch (Camel 4 uses the `main` branch)
# Tracking
- [x] If this is a large change, bug fix, or code improvement, I checked there is a [JIRA issue](https://issues.apache.org/jira/browse/CAMEL) filed for the change (usually before you start working on it).
<!--
# *Note*: trivial changes like, typos, minor documentation fixes and other small items do not require a JIRA issue. In this case your pull request should address just this issue, without pulling in other changes.
-->
# Apache Camel coding standards and style
- [x] I checked that each commit in the pull request has a meaningful subject line and body.
<!--
If you're unsure, you can format the pull request title like `[CAMEL-XXX] Fixes bug in camel-file component`, where you replace `CAMEL-XXX` with the appropriate JIRA issue.
-->
- [x] I have run `mvn clean install -DskipTests` locally from root folder and I have committed all auto-generated changes.
<!--
You can run the aforementioned command in your module so that the build auto-formats your code. This will also be verified as part of the checks and your PR may be rejected if if there are uncommited changes after running `mvn clean install -DskipTests`.
You can learn more about the contribution guidelines at https://github.com/apache/camel/blob/main/CONTRIBUTING.md
-->
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on PR #21951:
URL: https://github.com/apache/camel/pull/21951#issuecomment-4046078050
It seems to be a problem on the CI side, there is a stale container on the runner.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on code in PR #21951:
URL: https://github.com/apache/camel/pull/21951#discussion_r2923596662
##########
components/camel-mongodb/src/main/java/org/apache/camel/component/mongodb/SslAwareMongoClient.java:
##########
@@ -76,7 +76,7 @@ public MongoClient get() {
builder.invalidHostNameAllowed(true);
SSLContext sc = null;
try {
- sc = SSLContext.getInstance("TLSv1.2");
+ sc = SSLContext.getInstance("TLS");
Review Comment:
Yes, the approach of asking for the higher level should be expanded to all the components, but I want to investigate a bit the flow.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on code in PR #21951:
URL: https://github.com/apache/camel/pull/21951#discussion_r2923718148
##########
components/camel-mongodb/src/main/java/org/apache/camel/component/mongodb/SslAwareMongoClient.java:
##########
@@ -76,7 +76,7 @@ public MongoClient get() {
builder.invalidHostNameAllowed(true);
SSLContext sc = null;
try {
- sc = SSLContext.getInstance("TLSv1.2");
+ sc = SSLContext.getInstance("TLS");
Review Comment:
With "TLS", the JVM's security configuration (jdk.tls.disabledAlgorithms in java.security) controls which versions are actually enabled. On modern JVMs, TLS 1.0 and 1.1 are already disabled by default, so the effective range is TLS 1.2–1.3. When PQC key exchange becomes available (JDK 25+), "TLS" will automatically pick it up through TLS 1.3 without code changes. That's why it's the correct choice over hardcoding any specific version.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd commented on code in PR #21951:
URL: https://github.com/apache/camel/pull/21951#discussion_r2923725029
##########
components/camel-mongodb/src/main/java/org/apache/camel/component/mongodb/MongoDbComponent.java:
##########
@@ -54,6 +58,9 @@ protected Endpoint createEndpoint(String uri, String remaining, Map<String, Obje
MongoDbEndpoint endpoint = new MongoDbEndpoint(uri, this);
endpoint.setConnectionBean(remaining);
setProperties(endpoint, parameters);
+ if (endpoint.getSslContextParameters() == null) {
+ endpoint.setSslContextParameters(retrieveGlobalSslContextParameters());
+ }
Review Comment:
retrieveGlobalSslContextParameters() is a default method on the SSLContextParametersAware interface that already checks isUseGlobalSslContextParameters() internally:
```
default SSLContextParameters retrieveGlobalSslContextParameters() {
if (isUseGlobalSslContextParameters()) {
return getCamelContext().getSSLContextParameters();
}
return null;
}
```
If useGlobalSslContextParameters is false (the default), it returns null and nothing changes.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
Posted by "apupier (via GitHub)" <gi...@apache.org>.
apupier commented on code in PR #21951:
URL: https://github.com/apache/camel/pull/21951#discussion_r2923595985
##########
components/camel-mongodb/src/main/java/org/apache/camel/component/mongodb/MongoDbComponent.java:
##########
@@ -54,6 +58,9 @@ protected Endpoint createEndpoint(String uri, String remaining, Map<String, Obje
MongoDbEndpoint endpoint = new MongoDbEndpoint(uri, this);
endpoint.setConnectionBean(remaining);
setProperties(endpoint, parameters);
+ if (endpoint.getSslContextParameters() == null) {
+ endpoint.setSslContextParameters(retrieveGlobalSslContextParameters());
+ }
Review Comment:
Shouldn't we check that useGlobalSslContextParameters is true?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #21951:
URL: https://github.com/apache/camel/pull/21951#discussion_r2923493881
##########
components/camel-mongodb/src/main/java/org/apache/camel/component/mongodb/SslAwareMongoClient.java:
##########
@@ -76,7 +76,7 @@ public MongoClient get() {
builder.invalidHostNameAllowed(true);
SSLContext sc = null;
try {
- sc = SSLContext.getInstance("TLSv1.2");
+ sc = SSLContext.getInstance("TLS");
Review Comment:
Do we not need to use TLSv1.3 or something like that anymore, it would be easier if "TLS" just means the latest secured version. There are maybe other camel components that have hardcoded v1.3 and if so maybe they can just be "TLS".
However before doing anything it would be good to research to be sure
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
Posted by "oscerd (via GitHub)" <gi...@apache.org>.
oscerd merged PR #21951:
URL: https://github.com/apache/camel/pull/21951
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-23182 - Post-Quantum Cryptography (PQC) readiness: camel-mongod… [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #21951:
URL: https://github.com/apache/camel/pull/21951#issuecomment-4045391026
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `build-all`, `build-dependents`, `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org