search

metosin / pohjavirta

Fast & Non-blocking Clojure wrapper for Undertow
169 stars 8 forks source link

(WIP) Support for HTTPS #22

Closed zharinov closed 4 years ago

zharinov commented 4 years ago

Basically, it's not that hard to pass couple options to enable SSL (and HTTP/2 as well). However, after some initial research, I have some questions to elaborate on:

  1. Are :key-managers and :trust-managers options needed as well, or it would be okay for users to pass it explicitly to SSLContext?
  2. Undertow docs mention Wildfly OpenSSL provider as the better performing alternative to the default one. But, (a) it means one more additional dependency and (b) can potentially cause problems with native GraalVM-based builds (#7).
  3. Wouldn't be this interface too low-level? For users who aren't so familiar with Java cryptography APIs, list of possible misconfigurations look pretty scary. For keys obtained via "Let's encrypt" or environment variables, potential user-friendly pem-string->ssl-context can be implemented using bouncycastle/bcpkix-jdk15on, but again: one more dependency. Plus, some additional responsibility is required for implementing it right way (this repo can be useful).
ikitommi commented 4 years ago

Looks good, thanks!

zharinov commented 4 years ago

https://github.com/bhauman/certifiable