finos/symphony-bdk-java

Enquiry for importing LetsEncrypt certificate

Opened this issue · 3 comments

hkw1831 commented

Hello,

We are using your lib with version 2.0.0

Currently we are using the following approach to setup ssl:

BdkCertificateConfig certificateConfig = new BdkCertificateConfig(); // then setup the certificate path
BdkBotConfig botConfig = new BdkBotConfig();
botConfig.setCertificate(certificateConfig);

Recently we found that the pod was migrated to has new certificates issued from Let's Encrypt, not from DigiCert, and we cannot connect anymore after importing new cert (javx.net.ssl.SSLHandshakeException: Remove host closed connection during handshake)

And from this page, we found that looks like we need to import a root cert and intermediate cert in order to auth.

https://support.symphony.com/hc/en-us/articles/21580125574420-Import-Let-s-Encrypt-certificates-for-GCP-Platform-into-truststore

Can you please advise how to setup in java code in order to import both cert? And do we need to upgrade to newer version like 2.2.0?

Thank you very much.

Regards,
Wing

yinan-symphony commented

Hi @hkw1831 ,

it is a certificat chain, you can convert these certs into one file (kinda like concatenation of certs content, the order is important, root first, followed by intermediate, a good search would be helpful) and configure it as usual.

Please note that the BDK 2.x is approaching EOS, I suggest considering the migration to BDK 3.x asap (https://github.com/finos/symphony-bdk-java/releases/tag/v3.0.0).

thx

Yinan

hkw1831 commented

Thank you very much.
for BDK 3.x, is it a must to compile with jdk17? For backward compatibility we may need to compile it by JDK8..
Thank you very much again

yinan-symphony commented

@hkw1831 , yes, it must be compiled with jdk17. Unfortunately, it s a breaking change, and cannot compiled by jdk18. pls check the release note, or bdk reference doc to see the migration actions to do.

If you are using BDK SpringBoot Starter, it s very recommended to pass to BDK3.0, it relies on SpringBoot 3.x (include many fixes of CVEs), which requires jdk17, BTW, jdk8 is EOL.