0

We meet a problem when we use https in camel-jetty. Once the key store file is changed(like delete or add a certification), how can we make the change take effect? Seems like by default, camel-jetty won't reload the change dynamically.

The sample code:

JettyHttpComponent jettyComponent = getContext().getComponent("jetty", JettyHttpComponent.class);
SslSelectChannelConnector sslConnector = new SslSelectChannelConnector();
SslContextFactory sslFactory = sslConnector.getSslContextFactory();
sslFactory.setNeedClientAuth(true);
sslFactory.setKeyStore("d:" + File.separator +"serverkeystore");
sslFactory.setKeyManagerPassword("serverkey");
sslFactory.setKeyStorePassword("serverkeystore");
sslFactory.setTrustStore("d:" + File.separator +"servertruststore");
sslFactory.setTrustStorePassword("servertruststore");
Map<Integer, SslSelectChannelConnector> connectors = new HashMap<Integer, SslSelectChannelConnector>();
connectors.put(443, sslConnector);
jettyComponent.setSslSocketConnectors(connectors);   
from("jetty:https://0.0.0.0/httpsservice")
    .id("httpsserver")
    .process(new Processor(){
        public void process(Exchange exchange) throws Exception {
            exchange.getOut().setBody("OK");
            exchange.getOut().setHeader(Exchange.HTTP_RESPONSE_CODE, 200);
        }
    });

But when we change the key store file dynamically, unless restart the application, the change won't take effect. Is there any way to make the change take effect?

Thanks

1

2 Answers 2

0

You can build an SSLContext (and pass it via an SslContextFactory) using a custom X509KeyManager and a custom X509TrustManager that will change its return values dynamically, instead of being loaded once and for all.

For performance reasons, instead of reloading the keystores every time one of their methods are called, I would cache the result and reload it once in a while only (perhaps every 5 minutes, this really depends on the usage you expect).

0

Keep two camel contexts alive with the same config. Apply the load balancer pattern http://camel.apache.org/load-balancer.html. Then periodically, check the keystore file for updates, if updates, take down one at a time. Make sure the load balancer is aware wich context to fire at.

Okay, I must admit I have not really thought it all through. The SSL part might make it a bit tricky. But it should be doable.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.