Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add ability to configure client TLS enabled protocol versions and cipher suites via Spring properties #635

Closed
mryangza opened this issue Mar 9, 2021 · 2 comments
Closed

Add ability to configure client TLS enabled protocol versions and cipher suites via Spring properties #635

mryangza opened this issue Mar 9, 2021 · 2 comments
Labels
status: ideal-for-contribution An issue that a contributor can help us with type: enhancement A general enhancement
Milestone
2.3.2

Comments

@mryangza
Copy link
Contributor

mryangza commented Mar 9, 2021

It would be useful if the enabled TLS protocol versions and cipher suites used by an HTTP client to Vault could be configurable via Spring properties (bound to the org.springframework.vault.support.SslConfiguration class). These could then be set on the SSL socket factory created by the underlying request factories created via the org.springframework.vault.client.ClientHttpRequestFactoryFactory class. It looks like Apache HTTP Components and Netty support setting this via their builders, I am unsure whether OkHttp does. It might require a custom SSL socket factory wrapper that decorates the sockets as they are created (before they are connected).

Thoughts? I am happy to attempt a PR.
@mp911de
Copy link
Member

mp911de commented Mar 9, 2021

Sounds good. We have a config class for ssl that we use to configure the ssl context. Feel free to submit a pull request.

@mp911de mp911de added status: ideal-for-contribution An issue that a contributor can help us with type: enhancement A general enhancement labels Mar 11, 2021
@mryangza
Copy link
Contributor Author

Great, I've already spent some time implementing this, I'll try and finish it off in the next little while.

mryangza added a commit to mryangza/spring-vault that referenced this issue Mar 15, 2021
@mryangza
Add ability to configure client TLS enabled protocol versions and cipher
0637d43 
suites via Spring properties

- Adding the ability to explicitly configure the enabled SSL protocol
versions and cipher suites used by the Vault HTTP client via the
following Spring properties:

* vault.ssl.enabled-protocols
* vault.ssl.enabled-cipher-suites

- Properties should be a comma-separated list of String constants that
correspond to those used by the enabled SSL provider.

Closes spring-projectsgh-635
mryangza added a commit to mryangza/spring-vault that referenced this issue Mar 15, 2021
@mryangza
Add ability to configure client TLS enabled protocol versions and cipher
3c04b42 
suites via Spring properties

- Adding the ability to explicitly configure the enabled SSL protocol
versions and cipher suites used by the Vault HTTP client via the
following Spring properties:

* vault.ssl.enabled-protocols
* vault.ssl.enabled-cipher-suites

- Properties should be a comma-separated list of String constants that
correspond to those used by the enabled SSL provider.

Closes spring-projectsgh-635
@mryangza mryangza mentioned this issue Mar 15, 2021
Closed
@mp911de mp911de added this to the 2.3.2 milestone Mar 16, 2021
mp911de added a commit that referenced this issue Mar 16, 2021
@mp911de
Polishing.
6b09379 
Make SslConfiguration.enabledProtocols and enabledCipherSuites non-null. Update since tags. Add author tags. Update documentation.

See gh-635
Original pull request: gh-640.
mp911de pushed a commit that referenced this issue Mar 16, 2021
@mryangza @mp911de
Add ability to configure client TLS enabled protocol versions and cip…
a85fa86 
…her suites via Spring properties.

- Adding the ability to explicitly configure the enabled SSL protocol
versions and cipher suites used by the Vault HTTP client via the
following Spring properties:

* vault.ssl.enabled-protocols
* vault.ssl.enabled-cipher-suites

- Properties should be a comma-separated list of String constants that
correspond to those used by the enabled SSL provider.

Closes gh-635
Original pull request: gh-640.
mp911de added a commit that referenced this issue Mar 16, 2021
@mp911de
Polishing.
5640cc0 
Make SslConfiguration.enabledProtocols and enabledCipherSuites non-null. Update since tags. Add author tags. Update documentation.

See gh-635
Original pull request: gh-640.
This was referenced Mar 16, 2021
Closed
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
status: ideal-for-contribution An issue that a contributor can help us with type: enhancement A general enhancement
Projects
None yet
Milestone
2.3.2
2 participants
@mp911de @mryangza