spring-cloud / spring-cloud/spring-cloud-gateway

Support using different types of store as a source of trusted TLS certificates

Open
#1,650 2 comments 3 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

waiting for votes
Dominant language
Java
Stars
4.9k
Forks
3.5k
Avg merge
20h 57m
Merged PRs (30d)
8

Description

Problem statement
Spring Cloud Gateway currently supports passing in a list of filenames pointing to certificates in PEM format (property spring.cloud.gateway.httpclient.ssl.trusted-x509-certificates). If this list is non-empty, the certificates will be loaded, and they will be considered the only trusted certificates.

Applications I work on are provided a Java KeyStore that should be used as a source of trusted certificates. I wish to use this unmodified, if at all possible. This is currently not supported by Spring Cloud Gateway.

Desired solution
Support JKS and/or PKCS#12 "keystores" as a source of trusted certificates.

Considered alternatives

  • I considered using a custom PropertySource that is provided the path to a keystore as input, and solely provides the spring.cloud.gateway.httpclient.ssl.trusted-x509-certificates property. To do this, the input keystore must be converted to a format understood by Spring Cloud Gateway as it is currently implemented. At first glance, this seems complex.
  • As we would be deploying our applications in Kubernetes, I could use an init container to do the work of transforming the truststore to a format currently understood by Spring Cloud Gateway
  • Because we're deploying to Kubernetes, we could mount the provided truststore into the location where the JVM stores its truststore, thereby overriding it entirely

Closing comments
If there's interest in this feature, I'm willing to attempt creating a PR that implements this. I'm not sure what to do with the current configuration possibility though: would we maintain two different ways of adding sources of trusted certificates, which means we'd need to merge them? Or would one replace the other?

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start from the spring.cloud.gateway.httpclient.ssl.trusted-x509-certificates property and trace the existing PEM certificate loading path. Define how JKS and PKCS#12 sources should coexist with the current list, then verify that the configured keystore certificates are used as trusted certificates.

Written by the indexing model from the issue text.

Assessment

Tech stack
java, spring, spring-boot
Domain
backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.