chore(QTDI-2053):use safer method to verify certificate #1141
Conversation
| if (acceptAnyCertificate) { | ||
| builder.hostnameVerifier((host, session) -> true); | ||
| builder.sslContext(createUnsafeSSLContext()); | ||
| } else if (keystoreLocation.isPresent()) { |
There was a problem hiding this comment.
Should we check if keystore is present or not, or, simply raise an exception when it is not present ? (maybe a question to @coheigea )
There was a problem hiding this comment.
I assume the code falls back to the JDK defaults if the keystore isn't present? If so that would be OK, and we could just log this.
| builder.hostnameVerifier(hostnameVerifier); | ||
| builder.sslContext(createSSLContext(keystoreLocation, keystoreType, keystorePassword, truststoreType)); | ||
| } else { | ||
| log.warn("Key store location is NOT present. "); |
There was a problem hiding this comment.
I'm not sure it is an issue to not have the keystore location defined. If not the default java certificate management will be used.
So maybe just :
log.info("TCK vault-client doesn't explicitly define the keystore location. You can use 'talend.vault.cache.client.vault.certificate.keystore.location' and 'talend.vault.cache.client.vault.certificate.keystore.type' to explicit it.")
or something like this...
|
0 New Issues
0 Fixed Issues
0 Accepted Issues
| builder.hostnameVerifier(hostnameVerifier); | ||
| builder.sslContext(createSSLContext(keystoreLocation, keystoreType, keystorePassword, truststoreType)); | ||
| } else { | ||
| log.info("TCK vault-client doesn't explicitly define the keystore location. Please configure " + |
Requirements
Why this PR is needed?
What does this PR adds (design/code thoughts)?