Migrate more code away from X-Pack SSL #76142
Conversation
This commit is a bundle of changes to support the removal of X-Pack SSL in favour of the ssl-config library. The main changes are: 1. Migrating some certificate management in PKI and SAML realm to use ssl-config 2. Updating a variety of test cases to use ssl-config for their SSL setup and verification
|
Pinging @elastic/es-security (Team:Security) |
|
This should be the last PR before we make the big cut over. |
x-pack/plugin/core/src/main/java/org/elasticsearch/xpack/core/ssl/CertParsingUtils.java
Outdated
Show resolved
Hide resolved
|
@elasticmachine update branch |
|
@jkakavas Do you want to review this one before I merge? |
|
Yes, apologies, I will take a look today
…On Tuesday, August 17, 2021, Tim Vernum ***@***.***> wrote:
@jkakavas <https://github.com/jkakavas> Do you want to review this one
before I merge?
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#76142 (comment)>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ACOOCKG253UQ4XDVXQOVMP3T5G77DANCNFSM5BS5LZ4A>
.
Triage notifications on the go with GitHub Mobile for iOS
<https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675>
or Android
<https://play.google.com/store/apps/details?id=com.github.android&utm_campaign=notification-email>
.
|
| if (keyConfig.hasKeyMaterial() == false) { | ||
| return null; | ||
| } | ||
| final X509KeyManager keyManager = keyConfig.createKeyManager(); | ||
| if (keyManager == null) { |
There was a problem hiding this comment.
Nit but it just caught my eye while scrolling. Only EmptyKeyConfig#createKeyManager can return null and if this is an EmptyKeyConfig then we would have returned already because of if (keyConfig.hasKeyMaterial() == false) { above
There was a problem hiding this comment.
I don't think we want every use of KeyConfig to know that the case.
I suppose we could document a contract that is hasKeyMaterial is false, then createKeyManager may not return null, but otherwise I don't think it makes sense for SamlRealm to know about all the possible behaviours of KeyConfig and what the return value from one method might would imply about others.
This commit is a bundle of changes to support the removal of X-Pack
SSL in favour of the ssl-config library.
The main changes are:
ssl-config
setup and verification
Relates: #68719