ylliX - Online Advertising Network
Vertex AI - Antrophic and Mistral models: Why does it require Imegen access?

How can a Spring Boot SSL Bundle be created on demand


I have a Spring Boot SSL Bundle defined as follows

spring:
  ssl:
    bundle:
      watch:
        file:
          quiet-period: 20s
      pem:
        fos-internal-cert-bundle:
          reload-on-update: ${INTERNAL_CERT_RELOAD:true}
          keystore:
            certificate: ${INTERNAL_CERT:classpath:cert/client-certificate.pem}
            private-key: ${INTERNAL_CERT_PRIVATE_KEY:classpath:cert/private.key}

This SSL bundle is used in Rest Template as follows:

@Bean("restTemplateWithCertificate")
  public RestTemplate restTemplateWithBdfCertificate(
      RestTemplateBuilder builder, RestClientProperties clientProperties, SslBundles sslBundles) {
    SslBundle sslBundle = sslBundles.getBundle("fos-internal-cert-bundle");
    return builder
        .requestFactory(HttpComponentsClientHttpRequestFactory.class)
        .additionalInterceptors(new HeaderRequestInterceptor())
        .setReadTimeout(Duration.ofSeconds(clientProperties.getReadTimeoutSec()))
        .setConnectTimeout(Duration.ofSeconds(clientProperties.getConnectionTimeoutSec()))
        .setSslBundle(sslBundle)
        .build();
  }

The certificates that I am using are updated by a cron job and auto reloaded, as shown in the YAML fragment. I had the following questions:

  • Does the Rest Template bean automatically load the new certificate.
  • We have a situation where the cron job occasionally malfunctions and we need to have fall back design that will look like this. Is it create a new instance of the SSL Bundle and update the Singleton bean? Or should it be destroyed and recreated? (I know this is not possibly the most robust design
try{
 use restTemplate to call remote svc
} catch Exception {
   if SSL certificate expires, fetch updated certificate through an API
   call the remote svc again
}



Source link

Leave a Reply

Your email address will not be published. Required fields are marked *