spring-cloud / spring-cloud/spring-cloud-gateway
Support using different types of store as a source of trusted TLS certificates
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 4.9k
- Forks
- 3.5k
- Avg merge
- 20h 57m
- Merged PRs (30d)
- 8
Description
Problem statement
Spring Cloud Gateway currently supports passing in a list of filenames pointing to certificates in PEM format (property spring.cloud.gateway.httpclient.ssl.trusted-x509-certificates). If this list is non-empty, the certificates will be loaded, and they will be considered the only trusted certificates.
Applications I work on are provided a Java KeyStore that should be used as a source of trusted certificates. I wish to use this unmodified, if at all possible. This is currently not supported by Spring Cloud Gateway.
Desired solution
Support JKS and/or PKCS#12 "keystores" as a source of trusted certificates.
Considered alternatives
- I considered using a custom
PropertySourcethat is provided the path to a keystore as input, and solely provides thespring.cloud.gateway.httpclient.ssl.trusted-x509-certificatesproperty. To do this, the input keystore must be converted to a format understood by Spring Cloud Gateway as it is currently implemented. At first glance, this seems complex. - As we would be deploying our applications in Kubernetes, I could use an init container to do the work of transforming the truststore to a format currently understood by Spring Cloud Gateway
- Because we're deploying to Kubernetes, we could mount the provided truststore into the location where the JVM stores its truststore, thereby overriding it entirely
Closing comments
If there's interest in this feature, I'm willing to attempt creating a PR that implements this. I'm not sure what to do with the current configuration possibility though: would we maintain two different ways of adding sources of trusted certificates, which means we'd need to merge them? Or would one replace the other?
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start from the spring.cloud.gateway.httpclient.ssl.trusted-x509-certificates property and trace the existing PEM certificate loading path. Define how JKS and PKCS#12 sources should coexist with the current list, then verify that the configured keystore certificates are used as trusted certificates.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring, spring-boot
- Domain
- backend, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100