SslBundle integration with FeignClients

[ffroliva]

Recently, in spring-boot 3.1, spring team introduced the SslBundles component as a convenient way to configure SSL connection to RestTemplate and RestClient.

As reference: https://spring.io/blog/2023/06/07/securing-spring-boot-applications-with-ssl

I similar approach would be interesting to exist in the spring-cloud-openfeign.

I am currently taking the following approach:

application.yml

spring:
 ssl:
   bundle:
     jks:
       secure-service:
         key:
           alias: "secure-service"
         keystore:
           location: "classpath:keystore.p12"
           password: "myStrongPassword"
           type: "PKCS12"

    @Bean
    @ConditionalOnProperty(prefix = "spring.ssl.bundle.jks.secure-service.key", name = "alias")
    public Client feignClient(SslBundles sslBundles) throws Exception {
        // "secure-service" is defined in application properties
        try {
            SslBundle sslBundle = sslBundles.getBundle("secure-service");
            SSLContext sslContext = sslBundle.createSslContext();
            log.info("Configuring SSL Context for FeignClient");
            return new Client.Default(sslContext.getSocketFactory(), new DefaultHostnameVerifier());
        } catch (NoSuchSslBundleException ex) {
            log.error("SSLContext not provided. Creating FeignClient without sslContext.");
            throw new IllegalStateException("spring.ssl.bundle.jks.secure-service.key.alias not configure correctly. Please change your application properties, yml or environment configuration.");
        }
    }

I proposed approach would be similar to this:

    @Bean
    public restTemplate(RestTemplateBuilder restTemplateBuilder, SslBundles sslBundles) {
        this.restTemplate = restTemplateBuilder.setSslBundle(sslBundles.getBundle("secure-service")).build();
    }

Further reference: https://www.baeldung.com/spring-boot-security-ssl-bundles

[OlgaMaciaszek]

Hello @ffroliva, thanks for reporting the issue. Spring Cloud OpenFeign is now in maintenance only mode (we suggest migrating to Spring Interface Clients. We're not adding new features, only working on bugfixes and reviewing small community PRs, so we'll not be including this in the backlog.

[OlgaMaciaszek]

@ffroliva as written above, we won't be working on this, but seeing this is not a big change, let me know if you'd like to create a PR.

[samuelstein]

Good to know that openfeign is in maintenance mode. I didn't know before.
Would be nice if you could document this at least in the readme @OlgaMaciaszek.

[OlgaMaciaszek]

@samuelstein it's been in the docs for quite a long time: https://docs.spring.io/spring-cloud-openfeign/reference/, but you're right. I'll add this to the README as well.

[samuelstein]

I know but it is hidden on the first page. A hint on the project page (https://spring.io/projects/spring-cloud-openfeign#overview) would also be useful.

[OlgaMaciaszek]

I agree. I'll add this.

[goutamadwant]

@OlgaMaciaszek I've prepared a small Apache HttpClient 5 integration for this: spring.cloud.openfeign.httpclient.hc5.ssl-bundle selects a Boot SSL bundle for the shared auto-configured connection manager.

It preserves hostname verification and existing customization precedence, with HTTPS/mutual TLS regression coverage. The scope is HC5; per-client bundles and automatic reload are not included.

Can you please take a look at #1411 thanks!