Return-Path: 
 <issues-return-1231-apmail-activemq-issues-archive=activemq.apache.org@activemq.apache.org>
X-Original-To: apmail-activemq-issues-archive@minotaur.apache.org
Delivered-To: apmail-activemq-issues-archive@minotaur.apache.org
Received: from mail.apache.org (hermes.apache.org [140.211.11.3])
	by minotaur.apache.org (Postfix) with SMTP id 18AF518337
	for <apmail-activemq-issues-archive@minotaur.apache.org>;
 Tue, 30 Jun 2015 19:16:06 +0000 (UTC)
Received: (qmail 40941 invoked by uid 500); 30 Jun 2015 19:16:05 -0000
Delivered-To: apmail-activemq-issues-archive@activemq.apache.org
Received: (qmail 40870 invoked by uid 500); 30 Jun 2015 19:16:05 -0000
Mailing-List: contact issues-help@activemq.apache.org; run by ezmlm
Precedence: bulk
List-Help: <mailto:issues-help@activemq.apache.org>
List-Unsubscribe: <mailto:issues-unsubscribe@activemq.apache.org>
List-Post: <mailto:issues@activemq.apache.org>
List-Id: <issues.activemq.apache.org>
Reply-To: dev@activemq.apache.org
Delivered-To: mailing list issues@activemq.apache.org
Received: (qmail 40762 invoked by uid 99); 30 Jun 2015 19:16:05 -0000
Received: from arcas.apache.org (HELO arcas.apache.org) (140.211.11.28)
    by apache.org (qpsmtpd/0.29) with ESMTP; Tue, 30 Jun 2015 19:16:05 +0000
Date: Tue, 30 Jun 2015 19:16:05 +0000 (UTC)
From: =?utf-8?Q?Michal_R=C5=AF=C5=BEi=C4=8Dka_=28JIRA=29?= <jira@apache.org>
To: issues@activemq.apache.org
Message-ID: <JIRA.12692378.1391116248000.61969.1435691765354@Atlassian.JIRA>
In-Reply-To: <JIRA.12692378.1391116248000@Atlassian.JIRA>
References: <JIRA.12692378.1391116248000@Atlassian.JIRA>
 <JIRA.12692378.1391116248877@arcas>
Subject: [jira] [Comment Edited] (AMQ-5008) Support for certificate
 revocation checking (with patch)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
X-JIRA-FingerPrint: 30527f35849b9dde25b450d4833f0394


    [ https://issues.apache.org/jira/browse/AMQ-5008?page=3Dcom.atlassian.j=
ira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=3D146088=
96#comment-14608896 ]=20

Michal R=C5=AF=C5=BEi=C4=8Dka edited comment on AMQ-5008 at 6/30/15 7:15 PM=
:
--------------------------------------------------------------

The fix introduces a potential regression - consider this scenario:
* the {{crlPath}} is defined (i.e. not null)
* the {{trustStoreAlgorithm}} is not "PKIX"

In this scenario, the {{Revocation checking is only supported with 'trustSt=
oreAlgorithm=3D"PKIX"}} warning is logged and {{tmf.getTrustManagers()}} on=
 line 117 throws {{IllegalStateException}}.



was (Author: mruza):
The fix introduces a potential regression - consider this scenario:
* the {{crlPath}} is defined (i.e. not null)
* the {{trustStoreAlgorithm}} is not "PKIX"
In this scenario, the {{Revocation checking is only supported with 'trustSt=
oreAlgorithm=3D"PKIX"}} warning is logged and {{tmf.getTrustManagers()}} on=
 line 117 throws {{IllegalStateException}}.


> Support for certificate revocation checking (with patch)
> --------------------------------------------------------
>
>                 Key: AMQ-5008
>                 URL: https://issues.apache.org/jira/browse/AMQ-5008
>             Project: ActiveMQ
>          Issue Type: New Feature
>          Components: Connector
>            Reporter: Michal R=C5=AF=C5=BEi=C4=8Dka
>            Assignee: Dejan Bosanac
>            Priority: Minor
>             Fix For: 5.12.0
>
>         Attachments: CRL_checking.patch
>
>
> Currently it's possible to require client authentication during SSL/TLS h=
andshake by adding {{needClientAuth=3Dtrue}} query string to the respective=
 connector URI. But it is not possible to configure revocation checking of =
the certificate submitted by the client.
> The attached patch adds the capability by introducing a new attribute - {=
{crl}} - of the {{org.apache.activemq.spring.SpringSslContext}} class and u=
pdating the {{org.apache.activemq.spring.SpringSslContext.createTrustManage=
rs()}} method to make use of the value specified for the attribute in the c=
orresponding {{<sslContext />}} tag as appropriate.
> The code is inspired by a similar code in jetty webserver: https://github=
.com/eclipse/jetty.project/blob/release-9/jetty-util/src/main/java/org/ecli=
pse/jetty/util/ssl/SslContextFactory.java#L927-L965
> Please consider it for merging.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)