Enable client certificate authentication (jooby-project#905)

dogrover · jknack · commit 6e6525f2b2c5 · 2017-10-20T09:52:44.000-03:00
- NettySslContext now explicitly requests client auth when `ssl.trust.cert` is used. Fix jooby-project#904 - NettySslContextTest now checks for this setting.
diff --git a/modules/jooby-netty/src/main/java/org/jooby/internal/netty/NettySslContext.java b/modules/jooby-netty/src/main/java/org/jooby/internal/netty/NettySslContext.java
@@ -222,6 +222,7 @@
 import io.netty.handler.ssl.ApplicationProtocolConfig.SelectedListenerFailureBehavior;
 import io.netty.handler.ssl.ApplicationProtocolConfig.SelectorFailureBehavior;
 import io.netty.handler.ssl.ApplicationProtocolNames;
+import io.netty.handler.ssl.ClientAuth;
 import io.netty.handler.ssl.OpenSsl;
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.ssl.SslContextBuilder;
@@ -239,7 +240,8 @@ static SslContext build(final Config conf) throws IOException, CertificateExcept
         ? conf.getString("ssl.keystore.password") : null;
     SslContextBuilder scb = SslContextBuilder.forServer(keyStoreCert, keyStoreKey, keyStorePass);
     if (conf.hasPath("ssl.trust.cert")) {
-      scb.trustManager(toFile(conf.getString("ssl.trust.cert"), tmpdir));
+      scb.trustManager(toFile(conf.getString("ssl.trust.cert"), tmpdir))
+         .clientAuth(ClientAuth.REQUIRE);
     }
     if (http2) {
       SslProvider provider = OpenSsl.isAlpnSupported() ? SslProvider.OPENSSL : SslProvider.JDK;
diff --git a/modules/jooby-netty/src/test/java/org/jooby/internal/netty/NettySslContextTest.java b/modules/jooby-netty/src/test/java/org/jooby/internal/netty/NettySslContextTest.java
@@ -26,6 +26,7 @@
 import io.netty.handler.ssl.ApplicationProtocolConfig.SelectedListenerFailureBehavior;
 import io.netty.handler.ssl.ApplicationProtocolConfig.SelectorFailureBehavior;
 import io.netty.handler.ssl.ApplicationProtocolNames;
+import io.netty.handler.ssl.ClientAuth;
 import io.netty.handler.ssl.OpenSsl;
 import io.netty.handler.ssl.SslContext;
 import io.netty.handler.ssl.SslContextBuilder;
@@ -61,6 +62,7 @@ public void sslTrustCert() throws Exception {
         .expect(unit-> {
           SslContextBuilder scb = unit.get(SslContextBuilder.class);
           expect(scb.trustManager(Paths.get("target", "unsecure.crt").toFile())).andReturn(scb);
+          expect(scb.clientAuth(ClientAuth.REQUIRE)).andReturn(scb);
         })
         .run(unit -> {
           assertNotNull(NettySslContext.build(conf.withValue("ssl.trust.cert",
