Repository navigation
[backport camel-4.22.x] CAMEL-25645: camel-milo - let the OPC UA client validate the server certificate against a trust list - #28053
Merged
davsclaus merged 5 commits intoOct 18, 2026
Conversation
…ertificate against a trust list milo-client and milo-browse kept the default certificate validator of the Eclipse Milo client configuration, which accepts any server certificate, and had no option to configure trust material. The client now validates the server certificate whenever the selected endpoint uses a security policy other than None, with the trust list in trustListDirectory or the validator in certificateValidator, and does not connect when neither is configured. The new trustAllCertificates option, marked insecure:ssl, accepts any server certificate. The same validator checks the certificate that the user identity token is encrypted with. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
The trust list validator checks the application URI, the validity period and the revocation status of the server certificate. As OPC UA requires, a certificate issued by a CA needs a revocation list of that CA in the trust list. The documentation describes these checks exactly. A missing trust configuration and a failed certificate or security check are logged at WARN, and the last connection failure is the cause of the "No connected" exception that a producer gets. The end-to-end test asserts that reason, and the unit tests cover revoked, expired, CA without revocation list and application URI cases. The connection cache id uses the class name of a custom validator. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
… the trust list A server certificate issued by a CA is refused with Bad_CertificateRevocationUnknown when the trust list holds no revocation list of that CA. The component documentation, the option description and the upgrade guide said the opposite, and now describe this requirement. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
…nerate On camel-4.22.x the connection cache id does not contain the requested publishing interval, so the cache id test expects the endpoint URI alone. The generated files are regenerated for this branch. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
…value before the consumers start (apache#27999) Since CAMEL-25626 a consumer also delivers a null value with a Bad status, so a client that connected before the test wrote Foo received the initial Bad value of the item as well, and mock:trustAll got 2 messages. The two changes were merged on main 26 seconds apart and neither PR build ran with the other. The consumer routes now start after the value is written, as MonitorItemTest does since CAMEL-25626, so Foo is the first notification of each client. Signed-off-by: Claus Ibsen <claus.ibsen@gmail.com> Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com> (cherry picked from commit eb14b16)
oscerd
added
the
backport
Contributor
|
🌟 Thank you for your contribution to the Apache Camel project! 🌟 🐫 Apache Camel Committers, please review the following items:
|
Contributor
|
🧪 CI tested the following changed modules:
🔬 Scalpel shadow comparison — Scalpel: 12 tested, 26 compile-only — current: 9 all testedMaveniverse Scalpel detected 38 affected modules (current approach: 9).
|
davsclaus
approved these changes
Oct 18, 2026
davsclaus
left a comment
davsclaus
left a comment
Contributor
There was a problem hiding this comment.
Thanks @oscerd.
Not a straight cherry-pick, so this was reviewed against 1109759 plus the test fix eb14b16 (#27999), which is folded in here. Every non-generated file matches main except for these, all of them needed on camel-4.22.x:
MiloClientConfiguration.toCacheId()andMiloClientConfigurationTestkeep the branch's cache id withoutrequestedPublishingInterval. That suffix comes from other main-only work, and the trust settings this PR appends to the cache id are the same as on main.SecurityUtilsis left alone. Oncamel-4.22.xit has noSECURITY_OPTION_OWNERSmap, andtrustallcertificatesis already inSECURITY_OPTIONSasinsecure:sslfor any component. So the security policy already seestrustAllCertificates=trueonmilo-client/milo-browse, and the option carriessecurity = "insecure:ssl"here as on main.
ServerCertificateTrust, the SubscriptionManager changes (the validator also covers the UsernameProvider for both the explicit username/password options and the URI user info), the docs and the three tests are the same as on main. Branch Milo is 1.1.6, so the API is the same as main's 1.1.8. The generated files are consistent: both component JSON copies are identical, indexes are sequential, the three options show up at component and endpoint level, and the configurers, URI factories, component DSL, endpoint DSL and catalog docs are all regenerated. CI is green. The incremental build ran camel-milo, including ServerCertificateValidationTest, ServerCertificateTrustTest (13 tests) and MiloClientConfigurationTest.
The upgrade guide note for this behaviour change (a client that used to connect to a Sign/SignAndEncrypt endpoint without trust settings now refuses to connect) is in #28055 on main, under "Upgrading from 4.22.2 to 4.22.3". That one can be merged once this is in.
LGTM.
Claude Code on behalf of Claus Ibsen
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #27824, with the test follow-up #27999, onto
camel-4.22.x.Original PRs: #27824 - CAMEL-25645: camel-milo - let the OPC UA client validate the server certificate against a trust list, and #27999 - CAMEL-25645: camel-milo - ServerCertificateValidationTest writes the value before the consumers start
Target branch:
camel-4.22.xCAMEL-25645
What it does
As on main,
milo-clientandmilo-browsevalidate the certificate of the OPC UA server when the selected endpoint uses a security policy other thanNone:trustListDirectory: Milo's file based trust list. It checks the chain, the validity period, the revocation status and the application URI. A CA-issued certificate needs a CRL of its CA in the trust list.certificateValidator: a custom validator.trustAllCertificates: markedinsecure:ssl.WARNthat says why.No connected.Adaptations for camel-4.22.x
This is not a straight cherry-pick, so it needs a review:
MiloClientConfiguration.toCacheId()keeps this branch's id and appends the trust settings, andMiloClientConfigurationTestexpects the endpoint URI alone without trust settings.SecurityUtilson this branch is keyed by option name only, and its existingtrustallcertificatesentry already covers the new option.Tests
MonitorItemMultiConnectionsCertTest, already@Disabled), includingServerCertificateTrustTest,MiloClientConfigurationTestand the end-to-endServerCertificateValidationTest.Claude Code on behalf of Andrea Cosentino
🤖 Generated with Claude Code