From 8c925237170a6327db0e59017d4e45cb1134bd19 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:03:20 +1000 Subject: [PATCH 1/3] Read nested TLS client certificate settings --- src/main/java/io/mapsmessaging/config/network/SslConfig.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/io/mapsmessaging/config/network/SslConfig.java b/src/main/java/io/mapsmessaging/config/network/SslConfig.java index e0cd845ee..b20a09eb1 100644 --- a/src/main/java/io/mapsmessaging/config/network/SslConfig.java +++ b/src/main/java/io/mapsmessaging/config/network/SslConfig.java @@ -33,8 +33,8 @@ public class SslConfig extends SslConfigDTO implements Config { public SslConfig(ConfigurationProperties config) { ConfigurationProperties securityProps = locateConfig(config); this.context = securityProps.getProperty("context", "tls"); - this.clientCertificateRequired = config.getBooleanProperty("clientCertificateRequired", false); - this.clientCertificateWanted = config.getBooleanProperty("clientCertificateWanted", false); + this.clientCertificateRequired = securityProps.getBooleanProperty("clientCertificateRequired", false); + this.clientCertificateWanted = securityProps.getBooleanProperty("clientCertificateWanted", false); this.crlUrl = config.getProperty("crlUrl", null); this.crlInterval = config.getLongProperty("crlInterval", 0); From e620e409da293af252ab2d2ad5be8745094409f3 Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:03:21 +1000 Subject: [PATCH 2/3] Expose optional client certificate principals --- .../java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java b/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java index bf11cef6e..8ca014611 100644 --- a/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java +++ b/src/main/java/io/mapsmessaging/network/io/impl/ssl/SSLEndPoint.java @@ -231,7 +231,7 @@ private SSLEngineResult handleSSLEngineResult(SSLEngineResult result) throws IOE @Override public Principal getEndPointPrincipal() { - if (sslEngine.getNeedClientAuth()) { + if (sslEngine.getNeedClientAuth() || sslEngine.getWantClientAuth()) { try { return sslEngine.getSession().getPeerPrincipal(); } catch (SSLPeerUnverifiedException e) { From cf656326f57a292533cb7698310b6357dad0adec Mon Sep 17 00:00:00 2001 From: Matthew Buckton Date: Fri, 7 Aug 2026 15:03:32 +1000 Subject: [PATCH 3/3] Test nested TLS client certificate settings --- .../config/network/SslConfigTest.java | 52 +++++++++++++++++++ 1 file changed, 52 insertions(+) create mode 100644 src/test/java/io/mapsmessaging/config/network/SslConfigTest.java diff --git a/src/test/java/io/mapsmessaging/config/network/SslConfigTest.java b/src/test/java/io/mapsmessaging/config/network/SslConfigTest.java new file mode 100644 index 000000000..2643a2f57 --- /dev/null +++ b/src/test/java/io/mapsmessaging/config/network/SslConfigTest.java @@ -0,0 +1,52 @@ +/* + * + * Copyright [ 2024 - 2026 ] MapsMessaging B.V. + * + * Licensed under the Apache License, Version 2.0 with the Commons Clause + * (the "License"); you may not use this file except in compliance with the License. + * You may obtain a copy of the License at: + * + * http://www.apache.org/licenses/LICENSE-2.0 + * https://commonsclause.com/ + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package io.mapsmessaging.config.network; + +import static org.junit.jupiter.api.Assertions.assertFalse; +import static org.junit.jupiter.api.Assertions.assertTrue; + +import io.mapsmessaging.configuration.ConfigurationProperties; +import org.junit.jupiter.api.Test; + +class SslConfigTest { + + @Test + void constructorReadsClientCertificateSettingsFromNestedTlsConfiguration() { + ConfigurationProperties keyStore = new ConfigurationProperties(); + keyStore.put("type", "JKS"); + keyStore.put("managerFactory", "SunX509"); + + ConfigurationProperties tls = new ConfigurationProperties(); + tls.put("clientCertificateRequired", true); + tls.put("clientCertificateWanted", false); + tls.put("keyStore", keyStore); + tls.put("trustStore", keyStore); + + ConfigurationProperties security = new ConfigurationProperties(); + security.put("tls", tls); + + ConfigurationProperties config = new ConfigurationProperties(); + config.put("security", security); + + SslConfig sslConfig = new SslConfig(config); + + assertTrue(sslConfig.isClientCertificateRequired()); + assertFalse(sslConfig.isClientCertificateWanted()); + } +}