vmware-archive/cloudfoundry-certificate-truster

Cloud Foundry Certificate Truster

Warning

Use of this library is strongly discouraged. Providing a library that essentially disables or bypasses a major facet of inter-application communication security, while convenient for development, also makes it easy for developers to deploy insecure applications to production. Platforms like Cloud Foundry have made it easier to centralize SSL certificate management at an operations level, eliminating any need for a library like this. As such, this library is not being actively maintained and there are no plans to publish further releases of the library.

Cloud Foundry Certificate Truster

CloudFoundryCertificateTruster will download certificates and add them to the JVM truststore at the earliest possible time.

Dependencies

Include the dependency in your Spring Boot project to activate the certificate truster.

Maven

<dependency>
  <groupId>io.pivotal.spring.cloud</groupId>
  <artifactId>cloudfoundry-certificate-truster</artifactId>
  <version>1.0.1.RELEASE</version>
</dependency>

Gradle

compile("io.pivotal.spring.cloud:cloudfoundry-certificate-truster:1.0.1.RELEASE")

Usage

Certificates can be specified by either or both of the following environment variables:

CF_TARGET=https://api.my-cf-domain.com

This will cause CloudFoundryCertificateTruster to download the certificate at api.my-cf-domain.com:443 and add it to the JVM’s truststore.

TRUST_CERTS=api.foo.com,api.bar.com:8443

This will cause CloudFoundryCertificateTruster to download the certificates at api.foo.com:443 and api.bar.com:8443 and add them to the JVM’s truststore. You can specify one or more comma separated hostnames, optionally with a port.

Note	The timeout for certificate download is 5 seconds. If any errors occur, they are printed to System.err.

Build

Build and test with Gradle:

./gradlew build

Install to your local Maven repository:

./gradlew install

License

Cloud Foundry Certificate Truster is Open Source software released under the Apache 2.0 license.

cloudfoundry-certificate-truster's Issues

Alternative library

I realize this library is essentially deprecated and no longer maintained. I'm curious if the Pivotal folks have a recommended alternative for Spring applications that require connecting to SSL resources where a self-signed cert or non-trusted cert chain is in use. We've used this library as a quick fix for getting around these issues without resorting to completely bypassing Java's SSL behaviors (ie. custom RequestFactory for RestTemplate that uses a blind TrustStrategy).

We're now trying to use a similar approach for integration tests such as using WireMock to serve mocked HTTPS payloads. This library only ever used the environment variable TRUST_CERTS and it would be convenient to have a general purpose library that allows deeper configuration such as by Spring application properties.

Any help would be greatly appreciated. My searches so far have come up short outside the obvious StackOverflow workarounds.

Publish release 1.0.2

In #4 you provided a new feature in a Snapshot version. That has been in January.
Could you do a final release please?

Release

Hi

Can you release the lib with the last commits ?
Thanks

Grant a permissive license

As of today this project is not published under any license. This makes usage legally doubtful if not even impossible.

Please consider releasing this project under a permissive license.

enable to set full content of certificate instead of having it downloaded

Hello guys,

Nice feature !
Just wondering if it makes sense to also give a way to set directly, using a system property, the content of the certificate to add to the truststore ?
Something similar to https://github.com/Orange-OpenSource/spring-boot-ssl-truststore-gen ?

Sebastien

Trust All Certs?

I believe I've implemented the truster correctly, but the errors I'm getting aren't any different than what I had prior.

[ERR] [ERROR] ErrorPageFilter - Forwarding to error page from request [/api/v1/endpoint] due to exception [403 Forbidden] <org.springframework.web.client.HttpClientErrorException: 403 Forbidden>org.springframework.web.client.HttpClientErrorException: 403 Forbidden

To rule out configuration issues I'm wondering if there's a way to accept all certs; a wildcard maybe?

Add logging in case of success

As of today only errors while obtaining the certificates will be logged. It would be great to have log output for a successful download and addition to the truststore as well.

Would it be ok to add this? Or would log output in this early phase of application initialisation break something?

Key Stores

This may show a lack in my understanding of the Java trust store is managed. However, I have a need to employ mutual authentication and was wondering if this would facilitate adding client certificates too?