Investigate support for Quarkus TLS Registry

[jamesnetherton]

Not sure if it's feasible since Camel already has SSLContextParameters etc. But might be worth investigating if it can be used to improve the general UX for TLS setup.

https://quarkus.io/guides/tls-registry-reference

[zhfeng]

I take a look at our extensions which depends on quarkus-vertx-http which has been added support for quarkus-tls-registry. There are some codes to check sslEnabled

camel-quarkus/extensions/vertx-websocket/runtime/src/main/java/org/apache/camel/quarkus/component/vertx/websocket/VertxWebsocketRecorder.java

Lines 58 to 70 in f2e6f05

	ServerSslConfig ssl = httpConfig.ssl;
	if (ssl != null) {
	CertificateConfig certificate = ssl.certificate;
	if (certificate != null) {
	if (certificate.files.isPresent() && certificate.keyFiles.isPresent()) {
	sslEnabled = true;
	}
	if (certificate.keyStoreFile.isPresent() && certificate.keyStorePassword.isPresent()) {
	sslEnabled = true;
	}
	}
	}

If it uses such quarkus.tls.* to config TLS, there is a potential issue? @jamesnetherton

[jamesnetherton]

If it uses such quarkus.tls.* to config TLS, there is a potential issue? @jamesnetherton

Yes possibly if quarkus.http.insecure-requests=disabled since there'd be no plain HTTP for the component to fall back on.

[jamesnetherton]

Yes possibly if quarkus.http.insecure-requests=disabled since there'd be no plain HTTP for the component to fall back on.

Actually after a quick test, it can work with the sever secured by quarkus.tls.*. What fails is the ability to do this check correctly:

camel-quarkus/extensions/vertx-websocket/runtime/src/main/java/org/apache/camel/quarkus/component/vertx/websocket/VertxWebsocketRecorder.java

Lines 89 to 94 in f2e6f05

	if (!hostKey.getHost().equals(HOST) || hostKey.getPort() != PORT) {
	String message = String.format(
	"Invalid host/port %s:%d. The host/port can only be configured as %s:%d",
	hostKey.getHost(), hostKey.getPort(), HOST, PORT);
	throw new IllegalArgumentException(message);
	}

Not a huge issue because we discourage explicit host / port configuration on the consumer. But I can see if I can improve things in this area.