Great work Thomas! See my response inline.
On Wed, 2014-01-22 at 18:47 +0100, Thomas Segismont wrote:
Hi,
I've just pushed the initial implementation for Bug 840403 in a topic
branch:
https://git.fedorahosted.org/cgit/rhq/rhq.git/commit/?h=bug/840403&id...
...
* Only valid certificates or self-signed certificates (certificate chain
size is 1) are supported now
Why this limitation? Is this because the CA or public key is not yet
trusted by the agent's JVM?
AS7 plugin must be able to work with self-signed certificates and
unknown certificate authorities (internal or not common). It also needs
to be able to find a key store for client cert authentication.
I think Standalone and Domain server plugin configurations should let
users define a key and a trust store for maximum customization.
Yes. I agree. The connection settings should provide the ability to
specify the location of the key and trust store files and what level of
enforcement is required (host name validation, CRL, encryption only w/
no authentication/validation, etc).
Additionally, without any resource specific connection settings the JVMs
global/default settings should be used. Thus allowing all certificates
to be managed/provided via the JVM's settings and to be overridden by
resource specific connection settings.
I believe that, by default, self-signed certificates and unknown
certificate authorities should not be trusted.
Assuming that the certificate trust has not been installed, I would
agree. However, if the public key for a self-signed certificate has been
installed in the certificate trust, it should be considered trusted.
--
Larry O'Leary
https://plus.google.com/+LarryOLeary