From e134b32eed4dfae3d096dc5b192556a68ef2cd17 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:03:02 +1000 Subject: [PATCH 1/2] Enforce required client certificates --- .../java/io/mapsmessaging/security/ssl/SslHelper.java | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src/main/java/io/mapsmessaging/security/ssl/SslHelper.java b/src/main/java/io/mapsmessaging/security/ssl/SslHelper.java index ab3d46ac..9bfcbe26 100644 --- a/src/main/java/io/mapsmessaging/security/ssl/SslHelper.java +++ b/src/main/java/io/mapsmessaging/security/ssl/SslHelper.java @@ -153,10 +153,14 @@ public static SSLContext createContext(String context, ConfigurationProperties c return sslContext; } - public static SSLEngine createSSLEngine(SSLContext sslContext, ConfigurationProperties tls){ + public static SSLEngine createSSLEngine(SSLContext sslContext, ConfigurationProperties tls) { SSLEngine sslEngine = sslContext.createSSLEngine(); - sslEngine.setNeedClientAuth(tls.getBooleanProperty("clientCertificateRequired", false)); - sslEngine.setWantClientAuth(tls.getBooleanProperty("clientCertificateWanted", false)); + boolean clientCertificateRequired = tls.getBooleanProperty("clientCertificateRequired", false); + if (clientCertificateRequired) { + sslEngine.setNeedClientAuth(true); + } else { + sslEngine.setWantClientAuth(tls.getBooleanProperty("clientCertificateWanted", false)); + } return sslEngine; } From 172b15baed9873f149cc55936e3aec2ade18e97a Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:03:03 +1000 Subject: [PATCH 2/2] Test client certificate authentication modes --- .../security/ssl/SslHelperTest.java | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/src/test/java/io/mapsmessaging/security/ssl/SslHelperTest.java b/src/test/java/io/mapsmessaging/security/ssl/SslHelperTest.java index 29d29187..90a81004 100644 --- a/src/test/java/io/mapsmessaging/security/ssl/SslHelperTest.java +++ b/src/test/java/io/mapsmessaging/security/ssl/SslHelperTest.java @@ -54,4 +54,25 @@ void simpleHelperTest() throws Exception { SSLEngine sslEngine = SslHelper.createSSLEngine(sslContext, new ConfigurationProperties() ); Assertions.assertNotNull(sslEngine); } + + @Test + void clientCertificateAuthenticationModesAreMutuallyExclusive() throws Exception { + SSLContext sslContext = SSLContext.getDefault(); + + assertClientAuthenticationMode(sslContext, false, false, false, false); + assertClientAuthenticationMode(sslContext, false, true, false, true); + assertClientAuthenticationMode(sslContext, true, false, true, false); + assertClientAuthenticationMode(sslContext, true, true, true, false); + } + + private void assertClientAuthenticationMode(SSLContext sslContext, boolean required, boolean wanted, boolean expectedRequired, boolean expectedWanted) { + ConfigurationProperties properties = new ConfigurationProperties(); + properties.put("clientCertificateRequired", required); + properties.put("clientCertificateWanted", wanted); + + SSLEngine sslEngine = SslHelper.createSSLEngine(sslContext, properties); + + Assertions.assertEquals(expectedRequired, sslEngine.getNeedClientAuth()); + Assertions.assertEquals(expectedWanted, sslEngine.getWantClientAuth()); + } }