Accept SSL certificates by providing a URL to use cert from within a jar

[pmaedel]

I have a cert.pem in my src/main/resources
I need it when running the app jarred as well as unjarred.

Specifying it faithfully in my application.properties as spring.r2dbc.properties.sslRootCert=classpath:cert.pem fails as r2dbc does not load the file via classpath: https://github.com/pgjdbc/r2dbc-postgresql/blob/main/src/main/java/io/r2dbc/postgresql/util/Assert.java#L130

Caused by: java.lang.IllegalArgumentException: sslRootCert must not be null and must exist
	at io.r2dbc.postgresql.util.Assert.requireFileExistsOrNull(Assert.java:131) ~[r2dbc-postgresql-0.8.4.RELEASE.jar:0.8.4.RELEASE]
	at io.r2dbc.postgresql.PostgresqlConnectionConfiguration$Builder.sslRootCert(PostgresqlConnectionConfiguration.java:641) ~[r2dbc-postgresql-0.8.4.RELEASE.jar:0.8.4.RELEASE]

I see two options: Either load the specified File via classloader#getResourceAsStream or accept an URL as a cert parameter instead of a String.

The issue was originally raised here: spring-projects/spring-data-r2dbc#430

[mp911de]

We should accept an URL to allow resolution from a class path resource for cert/root-cert/ssl key. Accepting an URL bears the risk that someone stores a remote URL like a HTTP URL which introduces blocking I/O when resolving the certificate. I don't really see an alternative as it doesn't make sense to introduce a fully-fledged resource abstraction.

We should adopt:

• PostgresqlConnectionConfiguration
• PostgresqlConnectionFactoryProvider
• Tests

to make this work.

[isabek]

I would like to work on it. Could you assign it to me, please?

[mp911de]

Sure. Feel free to submit a pull request. Let us know if there's something you need assistance with.

[davecramer]

We found that emulating libpq worked well. Putting the certs in ~/.postgres by default
Also what are you doing for the various levels of cert validation ?

[mp911de]

For VERIFY_CA we enable the trust manager, for VERIFY_FULL, we additionally verify the hostname with a HostnameVerifier. The other SSL modes enable just the encryption part according to the SSL handshake requirements.

[isabek]

@mp911de, what kind of test should I add? Could you assist me?