Skip to content

Commit

Permalink
Use the correct event type CertificateUpdatedEvent in TLS Registry re…
Browse files Browse the repository at this point in the history
…ference
  • Loading branch information
ppalaga committed Oct 16, 2024
1 parent 2c9a5ac commit 5a13aed
Showing 1 changed file with 17 additions and 17 deletions.
34 changes: 17 additions & 17 deletions docs/src/main/asciidoc/tls-registry-reference.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -218,15 +218,15 @@ This setting is important when using SNI, because it uses the first specified pa
PKCS12 keystores are single files that contain the certificate and the private key.

To configure a PKCS12 keystore:

[source,properties]
----
quarkus.tls.key-store.p12.path=server-keystore.p12
quarkus.tls.key-store.p12.password=secret
----

`.p12` files are password-protected, so you need to provide the password to open the keystore.

These files can include more than one certificate and private key.
If this is the case, take either of the following actions:

Expand Down Expand Up @@ -262,11 +262,11 @@ To configure a JKS keystore:
quarkus.tls.key-store.jks.path=server-keystore.jks
quarkus.tls.key-store.jks.password=secret
----

`.jks` files are password-protected, so you need to provide the password to open the keystore.
Also, they can include more than one certificate and private key.
If this is the case:

* Provide and configure the alias of the certificate and the private key you want to use:
+
[source,properties]
Expand All @@ -287,12 +287,12 @@ Server Name Indication (SNI) is a TLS extension that makes it possible for a cli
SNI enables a server to present different TLS certificates for multiple domains on a single IP address, which facilitates secure communication for virtual hosting scenarios.

To enable SNI:

[source,properties]
----
quarkus.tls.key-store.sni=true # Disabled by default
----

With SNI enabled, the client indicates the server name during the TLS handshake, which allows the server to select the appropriate certificate:

* When configuring the keystore with PEM files, multiple certificate (CRT) and key files must be provided.
Expand Down Expand Up @@ -360,7 +360,7 @@ quarkus.tls.trust-store.p12.path=client-truststore.p12
quarkus.tls.trust-store.p12.password=password
quarkus.tls.trust-store.p12.alias=my-alias
----

`.p12` files are password-protected, so you need to provide the password to open the truststore.
However, unlike keystores, the alias does not require a password because it contains a public certificate, not a private key.

Expand All @@ -378,7 +378,7 @@ quarkus.tls.trust-store.jks.path=client-truststore.jks
quarkus.tls.trust-store.jks.password=password
quarkus.tls.trust-store.jks.alias=my-alias
----

`.jks` files are password-protected, so you need to provide the password to open the truststore.
However, unlike keystores, the alias does not require a password because it contains a public certificate, not a private key.

Expand All @@ -402,7 +402,7 @@ quarkus.tls.trust-store.credentials-provider.bean-name=my-credentials-provider
# The key used to retrieve the truststore password, `password` by default
quarkus.tls.trust-store.credentials-provider.password-key=password
----

IMPORTANT: The credential provider can only be used with PKCS12 and JKS truststores.

=== Other properties
Expand Down Expand Up @@ -532,7 +532,7 @@ While extensions automatically use the TLS registry, you can also access the TLS

To access the TLS configuration, inject the `TlsConfigurationRegistry` bean.
You can retrieve a named TLS configuration by calling `get("<NAME>")` or the default configuration by calling `getDefault()`.

[source,java]
----
@Inject
Expand All @@ -542,7 +542,7 @@ TlsConfiguration def = certificates.getDefault().orElseThrow();
TlsConfiguration named = certificates.get("name").orElseThrow();
//...
----

The `TlsConfiguration` object contains the keystores, truststores, cipher suites, protocols, and other properties.
It also provides a way to create an `SSLContext` from the configuration.

Expand All @@ -561,9 +561,9 @@ To register a certificate in the TLS registry by using the extension, the _proce
TlsCertificateBuildItem item = new TlsCertificateBuildItem("named",
new MyCertificateSupplier());
----

The certificate supplier is a runtime object generally retrieved by using a recorder method.

.An example of a certificate supplier:
[source,java]
----
Expand Down Expand Up @@ -675,7 +675,7 @@ quarkus.tls.http.key-store.pem.0.cert=tls.crt
quarkus.tls.http.key-store.pem.0.key=tls.key
----

IMPORTANT: Impacted server and client may need to listen to the `CertificateReloadedEvent` to apply the new certificates.
IMPORTANT: Impacted server and client may need to listen to the `CertificateUpdatedEvent` to apply the new certificates.
This is automatically done for the Quarkus HTTP server, including the management interface if it is enabled.

ifndef::no-kubernetes-secrets-or-cert-manager[]
Expand Down Expand Up @@ -902,7 +902,7 @@ Ensure that the path matches the one used in the configuration (here `/etc/tls`)
. Deploy your application to use the certificate generated by OpenShift.
This will make the service available over HTTPS.

[NOTE]
[NOTE]
====
By setting the `quarkus.tls.key-store.pem.acme.cert` and `quarkus.tls.key-store.pem.acme.key` variables or their environment variable variant, the TLS registry will use the certificate and private key from the secret.
Expand Down Expand Up @@ -1174,7 +1174,7 @@ Even if the Quarkus Development CA is installed, you can generate a self-signed
----
quarkus tls generate-certificate --name my-cert --self-signed
----

This generates a self-signed certificate that the Quarkus Development CA does not sign.

=== Uninstalling the Quarkus Development CA
Expand Down

0 comments on commit 5a13aed

Please sign in to comment.