Notion of sslDefault in openliberty config for third party library or JDK and best practices

Manudebouc 0
Viewed 16

I need to define a custom SSL configuration in server.xml and use it as default in my openliberty server.

What is the impact of defining sslDefault in server.xml config. Will this override the JVM default and all third party libraries will transparent use this sslDefault ? Or we need to get the SSL config using SSLContext sslContext = JSSEHelper.getInstance().getSSLContext("defaultSSLConfig", Collections.emptyMap(), null) (like presented in https://openliberty.io/docs/latest/access-nosql-databases.html) and inject it in these libraries.

Any best practices to share ?

open-liberty
1 Answers

If you configure the transportSecurity-1.0 feature then the configuring sslDefault in server.xml will affect what is returned by SSLContext.getDefault so any library that makes use of this will gain the configuration. However a library that uses one of the SSLContext.getInstance methods will not, this is because that creates a new SSLContext instance which will be intialized by the library calling the init method. If the library calls init(null, null, null) then it'll be initialized with what the JVM considers the default had SSLContext.setDefault not been called.

Different libraries react differently, as I recall okhttp creates its own SSLContext and initializes it so will not be affected by the Liberty sslDefault configuration, but other libraries just use the default.

userGc520
Related