diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfiguration.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfiguration.java
index 20823f29c4a..c44cec3f21b 100644
--- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfiguration.java
+++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfiguration.java
@@ -39,6 +39,7 @@ import org.springframework.context.annotation.Import;
import org.springframework.retry.backoff.ExponentialBackOffPolicy;
import org.springframework.retry.policy.SimpleRetryPolicy;
import org.springframework.retry.support.RetryTemplate;
+import org.springframework.util.ReflectionUtils;
/**
* {@link EnableAutoConfiguration Auto-configuration} for {@link RabbitTemplate}.
@@ -87,6 +88,11 @@ public class RabbitAutoConfiguration {
@ConditionalOnMissingBean(ConnectionFactory.class)
protected static class RabbitConnectionFactoryCreator {
+ // Only available in rabbitmq-java-client 5.4.0 +
+ private static final boolean CAN_ENABLE_HOSTNAME_VERIFICATION = ReflectionUtils
+ .findMethod(com.rabbitmq.client.ConnectionFactory.class,
+ "enableHostnameVerification") != null;
+
@Bean
public CachingConnectionFactory rabbitConnectionFactory(RabbitProperties config)
throws Exception {
@@ -117,6 +123,16 @@ public class RabbitAutoConfiguration {
factory.setKeyStorePassphrase(ssl.getKeyStorePassword());
factory.setTrustStore(ssl.getTrustStore());
factory.setTrustStorePassphrase(ssl.getTrustStorePassword());
+ factory.setSkipServerCertificateValidation(
+ !ssl.isValidateServerCertificate());
+ if (ssl.getVerifyHostname() != null) {
+ factory.setEnableHostnameVerification(ssl.getVerifyHostname());
+ }
+ else {
+ if (CAN_ENABLE_HOSTNAME_VERIFICATION) {
+ factory.setEnableHostnameVerification(true);
+ }
+ }
}
if (config.getConnectionTimeout() != null) {
factory.setConnectionTimeout(config.getConnectionTimeout());
diff --git a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitProperties.java b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitProperties.java
index e78387f2e52..e18c9d65b0a 100644
--- a/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitProperties.java
+++ b/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/amqp/RabbitProperties.java
@@ -337,6 +337,17 @@ public class RabbitProperties {
*/
private String algorithm;
+ /**
+ * Whether to enable server side certificate validation.
+ */
+ private boolean validateServerCertificate = true;
+
+ /**
+ * Whether to enable hostname verification. Requires AMQP client 4.8 or above and
+ * defaults to true when a suitable client version is used.
+ */
+ private Boolean verifyHostname;
+
public boolean isEnabled() {
return this.enabled;
}
@@ -385,6 +396,22 @@ public class RabbitProperties {
this.algorithm = sslAlgorithm;
}
+ public boolean isValidateServerCertificate() {
+ return this.validateServerCertificate;
+ }
+
+ public void setValidateServerCertificate(boolean validateServerCertificate) {
+ this.validateServerCertificate = validateServerCertificate;
+ }
+
+ public Boolean getVerifyHostname() {
+ return this.verifyHostname;
+ }
+
+ public void setVerifyHostname(Boolean verifyHostname) {
+ this.verifyHostname = verifyHostname;
+ }
+
}
public static class Cache {
diff --git a/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfigurationTests.java b/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfigurationTests.java
index 7c03a568b6f..9866f52cafb 100644
--- a/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfigurationTests.java
+++ b/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/amqp/RabbitAutoConfigurationTests.java
@@ -1,5 +1,5 @@
/*
- * Copyright 2012-2017 the original author or authors.
+ * Copyright 2012-2018 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -18,8 +18,10 @@ package org.springframework.boot.autoconfigure.amqp;
import javax.net.SocketFactory;
import javax.net.ssl.SSLSocketFactory;
+import javax.net.ssl.TrustManager;
import com.rabbitmq.client.Address;
+import com.rabbitmq.client.NullTrustManager;
import org.aopalliance.aop.Advice;
import org.junit.After;
import org.junit.Rule;
@@ -53,6 +55,7 @@ import org.springframework.retry.backoff.ExponentialBackOffPolicy;
import org.springframework.retry.interceptor.MethodInvocationRecoverer;
import org.springframework.retry.policy.SimpleRetryPolicy;
import org.springframework.retry.support.RetryTemplate;
+import org.springframework.test.util.ReflectionTestUtils;
import static org.assertj.core.api.Assertions.assertThat;
import static org.mockito.Mockito.mock;
@@ -411,6 +414,8 @@ public class RabbitAutoConfigurationTests {
com.rabbitmq.client.ConnectionFactory rabbitConnectionFactory = getTargetConnectionFactory();
assertThat(rabbitConnectionFactory.getSocketFactory())
.as("SocketFactory must use SSL").isInstanceOf(SSLSocketFactory.class);
+ TrustManager trustManager = getTrustManager(rabbitConnectionFactory);
+ assertThat(trustManager).isNotInstanceOf(NullTrustManager.class);
}
@Test
@@ -422,7 +427,38 @@ public class RabbitAutoConfigurationTests {
"spring.rabbitmq.ssl.keyStore=foo",
"spring.rabbitmq.ssl.keyStorePassword=secret",
"spring.rabbitmq.ssl.trustStore=bar",
- "spring.rabbitmq.ssl.trustStorePassword=secret");
+ "spring.rabbitmq.ssl.trustStorePassword=secret",
+ "spring.rabbitmq.ssl.validateServerCertificate=false");
+ getTargetConnectionFactory();
+ }
+
+ @Test
+ public void enableSslWithValidateServerCertificateFalse() throws Exception {
+ load(TestConfiguration.class, "spring.rabbitmq.ssl.enabled:true",
+ "spring.rabbitmq.ssl.validateServerCertificate=false");
+ com.rabbitmq.client.ConnectionFactory rabbitConnectionFactory = getTargetConnectionFactory();
+ TrustManager trustManager = getTrustManager(rabbitConnectionFactory);
+ assertThat(trustManager).isInstanceOf(NullTrustManager.class);
+ }
+
+ @Test
+ public void enableSslWithValidateServerCertificateDefault() throws Exception {
+ load(TestConfiguration.class, "spring.rabbitmq.ssl.enabled:true");
+ com.rabbitmq.client.ConnectionFactory rabbitConnectionFactory = getTargetConnectionFactory();
+ TrustManager trustManager = getTrustManager(rabbitConnectionFactory);
+ assertThat(trustManager).isNotInstanceOf(NullTrustManager.class);
+ }
+
+ private TrustManager getTrustManager(
+ com.rabbitmq.client.ConnectionFactory rabbitConnectionFactory) {
+ Object sslContext = ReflectionTestUtils.getField(rabbitConnectionFactory,
+ "sslContext");
+ Object spi = ReflectionTestUtils.getField(sslContext, "contextSpi");
+ Object trustManager = ReflectionTestUtils.getField(spi, "trustManager");
+ while (trustManager.getClass().getName().endsWith("Wrapper")) {
+ trustManager = ReflectionTestUtils.getField(trustManager, "tm");
+ }
+ return (TrustManager) trustManager;
}
private com.rabbitmq.client.ConnectionFactory getTargetConnectionFactory() {
diff --git a/spring-boot-dependencies/pom.xml b/spring-boot-dependencies/pom.xml
index 98d125c8594..6a10e69df81 100644
--- a/spring-boot-dependencies/pom.xml
+++ b/spring-boot-dependencies/pom.xml
@@ -140,6 +140,7 @@
2.1.6
9.4.1212.jre7
4.1.4
+ 4.0.3
2.0.8.RELEASE
2.0.7.RELEASE
2.53.1
@@ -152,7 +153,7 @@
5.5.5
1.0-groovy-2.4
4.3.18.RELEASE
- 1.7.9.RELEASE
+ 1.7.10.BUILD-SNAPSHOT
1.2.6.RELEASE
3.0.9.RELEASE
Ingalls-SR14
@@ -730,6 +731,11 @@
+
+ com.rabbitmq
+ amqp-client
+ ${rabbit-amqp-client.version}
+
com.samskivert
jmustache
@@ -3263,4 +3269,4 @@
integration-test
-
\ No newline at end of file
+
diff --git a/spring-boot-samples/spring-boot-sample-amqp/pom.xml b/spring-boot-samples/spring-boot-sample-amqp/pom.xml
index 94c200de2be..3b6d1ba42fc 100644
--- a/spring-boot-samples/spring-boot-sample-amqp/pom.xml
+++ b/spring-boot-samples/spring-boot-sample-amqp/pom.xml
@@ -1,5 +1,7 @@
-
+
4.0.0
@@ -17,6 +19,7 @@
${basedir}/../..
+ 4.8.0