Skip to content

Improve naming of the SSL options#1070

Open
tinaselenge wants to merge 1 commit intostrimzi:mainfrom
tinaselenge:fix-ssl-options
Open

Improve naming of the SSL options#1070
tinaselenge wants to merge 1 commit intostrimzi:mainfrom
tinaselenge:fix-ssl-options

Conversation

@tinaselenge
Copy link
Contributor

@tinaselenge tinaselenge commented Feb 11, 2026

Based on the recent discussion, naming for some of the SSL properties were confusing as they mix "keystore" terminology with PEM certificate/key terminology. This PR attempts to make them clearer, with more consistent terminology.

In the future, if we need to support more formats (not sure if we will ever need to do), we could add:

  • http.ssl.format=PEM | PKCS12 | JKS (default: PEM)
  • http.ssl.keystore.password (when needed for pkcs12/jks)

Signed-off-by: Gantigmaa Selenge <tina.selenge@gmail.com>
@tinaselenge tinaselenge marked this pull request as ready for review February 11, 2026 21:09
Copy link
Member

@scholzj scholzj left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not entirely sure why did you changed location to path. I'm pretty flexible and can use both. But given Kafka uses location, I wonder if that was better? (that said, the option names anyway differ, so maybe we don't care?)

|http.ssl.keystore.certificate.chain
|The HTTP Bridge server keystore certificate in PEM format.
PEM is the only format supported for keystore.
|http.ssl.certificate
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So, if we call this http.ssl.certificate / http.ssl.certificate.path ... how would we call the trusted certificates if we one day add support for mTLS authentication?

@scholzj scholzj added this to the 0.34.0 milestone Feb 17, 2026
@ppatierno
Copy link
Member

@tinaselenge I had a view and my thoughts are:

  • I would stick with location and not using path. Users using the HTTP bridge are more familiar with Apache Kafka naming than internal stuff (the Java methods using Path).
  • Also I would take keystore as well.

Tbh at this point I am not sure why we are making these changes here.

@katheris
Copy link
Member

I think the confusion here is that the settings are similar to the Kafka settings, but actually the way the user provides them is different from Kafka. So for example in Kafka you can provide these configurations for files:
ssl.keystore.type (PEM or JKS or PKCS12)
ssl.keystore.location
ssl.keystore.password
ssl.key.password
ssl.truststore.type (PEM or JKS or PKCS12)
ssl.truststore.location
ssl.truststore.password

Where ssl.keystore.location contains both the private key and the public certificate. Whereas for Bridge we have the key and certificate as separate files:
http.ssl.keystore.certificate.location
http.ssl.keystore.key.location

So given the starting point I'm not sure what can be changed to make it less confusing

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants

Comments