Skip to content

Conversation

tvernum
Copy link
Contributor

@tvernum tvernum commented Jul 31, 2025

This change introduces a new SslProfile class.

The SslProfile is roughly analogous to SslConfiguration and provides the runtime implementation support for an "ssl context" (but here called a "profile" because SSLContext is already a thing).

This means that a number of methods that were previously called on SSLService are now called on a contextual SslProfile.
For example, SSLService.getHostnameVerifier(SslConfiguration) is now SslProfile.hostnameVerifier()

This has two primary benefits

  1. Moving these methods out of SSLService provides a cleaner split. SSLService is now (more of) a manager for accessing profiles and configurations, and the profiles provide the runtime support for creating SSL connections.
  2. It moves us a step towards having extensible SSL contexts/profiles. Because a SslProfile is self contained, we can inject one into a defined extension point without needing any direct reference to an SSLService. That is we can work towards an SPI extension point such as
    public interface SslExtension {
         public Set<String> getSslProfileNames();
         public void applySslProfile(String name, SslProfile profile);
    }
    
    and that interface doesn't need to know anything more than what is contained in SslProfile (it knows nothing of SSLService).

@tvernum tvernum requested a review from slobodanadamovic July 31, 2025 07:55
@tvernum tvernum added :Security/TLS SSL/TLS, Certificates >refactoring labels Jul 31, 2025
@elasticsearchmachine elasticsearchmachine added v9.2.0 Team:Security Meta label for security team labels Jul 31, 2025
@elasticsearchmachine
Copy link
Collaborator

Pinging @elastic/es-security (Team:Security)

@tvernum
Copy link
Contributor Author

tvernum commented Jul 31, 2025

@slobodanadamovic No rush on this. I'm not likely to have time to come back to it for another couple of weeks anyway.

I tried to make each commit self contained, so if you want to review it commit-by-commit that should work quite well.

Copy link
Contributor

@slobodanadamovic slobodanadamovic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM 👍

Thanks for breaking refactoring into separate commits! Made it easier to review.

@tvernum tvernum enabled auto-merge (squash) August 29, 2025 01:00
@tvernum tvernum merged commit f31bef6 into elastic:main Aug 29, 2025
39 checks passed
JeremyDahlgren pushed a commit to JeremyDahlgren/elasticsearch that referenced this pull request Aug 29, 2025
This change introduces a new `SslProfile` class.

The `SslProfile` is roughly analogous to `SslConfiguration` and provides the runtime implementation support for an "ssl context" (but here called a "profile" because `SSLContext` is already a thing).

This means that a number of methods that were previously called on `SSLService` are now called on a contextual `SslProfile`.
For example, `SSLService.getHostnameVerifier(SslConfiguration)` is now `SslProfile.hostnameVerifier()`

This has two primary benefits
1. Moving these methods out of `SSLService` provides a cleaner split. `SSLService` is now (more of) a manager for accessing profiles and configurations, and the profiles provide the runtime support for creating SSL connections.
2. It moves us a step towards having extensible SSL contexts/profiles. Because a `SslProfile` is self contained, we can inject one into a defined extension point without needing any direct reference to an `SSLService`. That is we can work towards an SPI extension point such as
      ```
      public interface SslExtension {
           public Set<String> getSslProfileNames();
           public void applySslProfile(String name, SslProfile profile);
      }
      ```
      and that interface doesn't need to know anything more than what is contained in `SslProfile` (it knows nothing of `SSLService`).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

>refactoring :Security/TLS SSL/TLS, Certificates Team:Security Meta label for security team v9.2.0

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants