[QPID-7869] [Java Broker] Truststore improvements

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: qpid-java-broker-7.0.0
• Component/s: Broker-J
• Assignee: Keith Wall
• Reporter: Keith Wall
• Created: 25/Jul/17 11:00
• Updated: 02/Oct/19 19:22
• Resolved: 06/Sep/17 09:39

Description

The current TrustStore API requires some tidy up/improvements to allow an operator to better manage certificate expiry.

1. Currently the details of certificates contained within the store are not exposed in a uniform manner. {#getCertificateDetails}} should be pulled up and implemented by all truststore types. I suggest we standardise on the form currently used by ManagedPeerCertificateTrustStore#getCertificateDetails (i.e. the List<CertificateDetails>). For the SiteSpecificTrustStore it should return a singleton list.
2. KeyStores currently warn the user certificate are about to expire via operational log messages. TrustStores should implement the same feature.
3. For SSL client authentication, we should have a 'strict mode' where the validFrom/validTo date of the peer certificate is validated before the connection is accepted. This will help users utilising self signed certificate for client authentication purpose effectively managed certificate expiration.