Made building ssl context in builder way. Renamed SSLMode constants to match java naming convention. Misc fixes.

Author: chernser

clickhouse-client/src/main/java/com/clickhouse/client/config/ClickHouseDefaultSslContextProvider.java

@@ -154,38 +154,14 @@ public SSLContext getJavaSslContext(ClickHouseConfig config) throws SSLException
     }
 
     public SSLContext getSslContextFromCerts(String clientCert, String clientKey, String sslRootCert) throws SSLException {
-        return getSslContextFromCerts(ClickHouseSslMode.STRICT, clientCert, clientKey, sslRootCert);
-    }
-
-    /**
-     * Creates an SSL context from certificates with an explicit SSL mode.
-     * With {@link ClickHouseSslMode#NONE} the server certificate is not validated, while client
-     * certificate and key are still used (if provided) so that mTLS keeps working.
-     *
-     * @param sslMode    ssl mode
-     * @param clientCert client certificate for mTLS, file path or PEM content; may be null
-     * @param clientKey  client private key for mTLS, file path or PEM content; may be null
-     * @param sslRootCert CA certificate to validate the server certificate, file path or PEM content; may be null
-     * @return SSL context
-     * @throws SSLException when the context cannot be created
-     */
-    public SSLContext getSslContextFromCerts(ClickHouseSslMode sslMode, String clientCert, String clientKey,
-            String sslRootCert) throws SSLException {
-        return getSslContextImpl(sslMode, clientCert, clientKey, sslRootCert, null, null, KeyStore.getDefaultType());
+        return getSslContextImpl(ClickHouseSslMode.STRICT,
+                clientCert, clientKey, sslRootCert, null, null, KeyStore.getDefaultType());
     }
 
     public SSLContext getSslContextFromKeyStore(String truststorePath, String truststorePassword, String keyStoreType) throws SSLException {
         return getSslContextImpl(ClickHouseSslMode.STRICT, null, null, null, truststorePath, truststorePassword, keyStoreType);
     }
 
-    private KeyManager[] getKeyManagers(String clientCert, String clientKey)
-            throws NoSuchAlgorithmException, InvalidKeySpecException, IOException, CertificateException,
-            KeyStoreException, UnrecoverableKeyException {
-        KeyManagerFactory factory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
-        factory.init(getKeyStore(clientCert, clientKey), null);
-        return factory.getKeyManagers();
-    }
-
     private SSLContext getSslContextImpl(ClickHouseSslMode sslMode, String clientCert, String clientKey, String sslRootCert, String truststorePath, String truststorePassword, String keyStoreType) throws SSLException {
         SSLContext ctx;
         try {
@@ -196,29 +172,34 @@ private SSLContext getSslContextImpl(ClickHouseSslMode sslMode, String clientCer
 
             if (sslMode == ClickHouseSslMode.NONE) {
                 tms = new TrustManager[]{new NonValidatingTrustManager()};
-                // client certificate and key are independent from server verification - keep mTLS working
-                kms = clientCert != null && !clientCert.isEmpty() ? getKeyManagers(clientCert, clientKey)
-                        : new KeyManager[0];
+                kms = new KeyManager[0];
                 sr = new SecureRandom();
             } else if (sslMode == ClickHouseSslMode.STRICT) {
-                if (clientCert != null && !clientCert.isEmpty()) {
-                    kms = getKeyManagers(clientCert, clientKey);
-                }
-
                 if (truststorePath != null && !truststorePath.isEmpty()) {
+
                     try (InputStream in = ClickHouseUtils.getFileInputStream(truststorePath)) {
                         KeyStore myTrustStore = KeyStore.getInstance(keyStoreType);
-                        myTrustStore.load(in, truststorePassword == null ? null : truststorePassword.toCharArray());
+                        myTrustStore.load(in, truststorePassword.toCharArray());
                         TrustManagerFactory factory = TrustManagerFactory
                                 .getInstance(TrustManagerFactory.getDefaultAlgorithm());
                         factory.init(myTrustStore);
                         tms = factory.getTrustManagers();
+
+                    }
+                } else {
+                    if (clientCert != null && !clientCert.isEmpty()) {
+                        KeyManagerFactory factory = KeyManagerFactory
+                                .getInstance(KeyManagerFactory.getDefaultAlgorithm());
+                        factory.init(getKeyStore(clientCert, clientKey), null);
+                        kms = factory.getKeyManagers();
+                    }
+
+                    if (sslRootCert != null && !sslRootCert.isEmpty()) {
+                        TrustManagerFactory factory = TrustManagerFactory
+                                .getInstance(TrustManagerFactory.getDefaultAlgorithm());
+                        factory.init(getKeyStore(sslRootCert, null));
+                        tms = factory.getTrustManagers();
                     }
-                } else if (sslRootCert != null && !sslRootCert.isEmpty()) {
-                    TrustManagerFactory factory = TrustManagerFactory
-                            .getInstance(TrustManagerFactory.getDefaultAlgorithm());
-                    factory.init(getKeyStore(sslRootCert, null));
-                    tms = factory.getTrustManagers();
                 }
 
                 sr = new SecureRandom();

client-v2/src/main/java/com/clickhouse/client/api/Client.java

@@ -761,12 +761,13 @@ public Builder setClientKey(String path) {
          *
          * <p>Supported modes:</p>
          * <ul>
-         *     <li>{@link SSLMode#Disabled} - SSL is not used; only meaningful with plain protocols</li>
-         *     <li>{@link SSLMode#Trust} - encrypt, but accept any server certificate and skip
+         *     <li>{@link SSLMode#DISABLED} - SSL is not used; only meaningful with plain protocols</li>
+         *     <li>{@link SSLMode#TRUST} - encrypt, but accept any server certificate and skip
+         *     hostname verification; a configured trust store or CA certificate is ignored (a warning
+         *     is logged), while a client certificate/key is still applied for mTLS</li>
+         *     <li>{@link SSLMode#VERIFY_CA} - validate the server certificate chain, but skip
          *     hostname verification</li>
-         *     <li>{@link SSLMode#VerifyCa} - validate the server certificate chain, but skip
-         *     hostname verification</li>
-         *     <li>{@link SSLMode#Strict} - full verification of the certificate chain and the
+         *     <li>{@link SSLMode#STRICT} - full verification of the certificate chain and the
          *     hostname (default)</li>
          * </ul>
          *
@@ -1168,6 +1169,21 @@ public Client build() {
                 throw new ClientMisconfigurationException("Trust store and certificates cannot be used together");
             }
 
+            // A trust store and a CA certificate are not rejected here: for VERIFY_CA/STRICT the trust
+            // store takes precedence and the CA certificate is ignored with a warning (see createSSLContext).
+
+            // SSLMode.DISABLED does not turn encryption off - the endpoint scheme decides that. So it
+            // contradicts a secure (https) endpoint and must be rejected here, before the client is created.
+            if (SSLMode.DISABLED.name().equals(configuration.get(ClientConfigProperties.SSL_MODE.getKey()))) {
+                for (Endpoint endpoint : this.endpoints) {
+                    if ("https".equalsIgnoreCase(endpoint.getURI().getScheme())) {
+                        throw new ClientMisconfigurationException("SSL mode '" + SSLMode.DISABLED
+                                + "' cannot be used with a secure (https) endpoint. Use '" + SSLMode.TRUST
+                                + "' to trust all certificates or use plain HTTP.");
+                    }
+                }
+            }
+
             // Check timezone settings
             String useTimeZoneValue = this.configuration.get(ClientConfigProperties.USE_TIMEZONE.getKey());
             String serverTimeZoneValue = this.configuration.get(ClientConfigProperties.SERVER_TIMEZONE.getKey());

client-v2/src/main/java/com/clickhouse/client/api/ClientConfigProperties.java

@@ -116,7 +116,7 @@ public enum ClientConfigProperties {
 
     SSL_CERTIFICATE("sslcert", String.class),
 
-    SSL_MODE("ssl_mode", SSLMode.class, SSLMode.Strict.name()),
+    SSL_MODE("ssl_mode", SSLMode.class, SSLMode.STRICT.name()),
 
     RETRY_ON_FAILURE("retry", Integer.class, "3"),
 

client-v2/src/main/java/com/clickhouse/client/api/enums/SSLMode.java

@@ -9,40 +9,43 @@
  *
  * <p>Modes from the least to the most strict:</p>
  * <ul>
- *     <li>{@link #Disabled} - SSL is not used. Plain protocols only.</li>
- *     <li>{@link #Trust} - encryption is used, but the server certificate chain is not validated
- *     and the hostname is not verified. Susceptible to MITM attacks - use only for testing or in
- *     fully trusted environments.</li>
- *     <li>{@link #VerifyCa} - the server certificate chain is validated against the trust material
+ *     <li>{@link #DISABLED} - SSL is not used. Plain protocols only.</li>
+ *     <li>{@link #TRUST} - the hostname is not verified and any server certificate is accepted, which
+ *     is susceptible to MITM attacks - use that only for testing or in fully trusted environments. A
+ *     configured trust store or CA certificate has no effect in this mode and is ignored (a warning is
+ *     logged); a configured client certificate/key is still applied for mTLS.</li>
+ *     <li>{@link #VERIFY_CA} - the server certificate chain is validated against the trust material
  *     (default JVM trust store, configured trust store, or a CA certificate), but the hostname is
  *     not checked against the certificate.</li>
- *     <li>{@link #Strict} - full verification (default): certificate chain is validated and the
+ *     <li>{@link #STRICT} - full verification (default): certificate chain is validated and the
  *     hostname must match the certificate.</li>
  * </ul>
  */
 public enum SSLMode {
 
     /**
-     * SSL is not used. Connection is not encrypted.
+     * SSL is not used. Connection is not encrypted. Doesn't work with HTTPS.
+     * Reserved for TCP where protocol doesn't define encryption.
      */
-    Disabled,
+    DISABLED,
 
     /**
-     * Encryption without verification: any server certificate is accepted and
-     * the hostname is not verified.
+     * The hostname is not verified and any server certificate is accepted. A configured trust store or
+     * CA certificate has no effect in this mode and is ignored (a warning is logged). A configured
+     * client certificate/key is still applied for mTLS.
      */
-    Trust,
+    TRUST,
 
     /**
      * Server certificate chain is validated, but the hostname is not verified.
      */
-    VerifyCa,
+    VERIFY_CA,
 
     /**
      * Full verification: certificate chain is validated and the hostname must match
-     * the certificate. Default mode.
+     * the certificate. Default mode for HTTPs.
      */
-    Strict;
+    STRICT;
 
     /**
      * Case-insensitive variant of {@link #valueOf(String)}.

client-v2/src/main/java/com/clickhouse/client/api/internal/HttpAPIClientHelper.java

@@ -12,10 +12,8 @@
 import com.clickhouse.client.api.ServerException;
 import com.clickhouse.client.api.enums.ProxyType;
 import com.clickhouse.client.api.enums.SSLMode;
-import com.clickhouse.client.config.ClickHouseSslMode;
 import com.clickhouse.client.api.http.ClickHouseHttpProto;
 import com.clickhouse.client.api.transport.Endpoint;
-import com.clickhouse.client.config.ClickHouseDefaultSslContextProvider;
 import com.clickhouse.data.ClickHouseFormat;
 import net.jpountz.lz4.LZ4Factory;
 import org.apache.commons.compress.compressors.CompressorStreamFactory;
@@ -69,7 +67,6 @@
 import javax.net.ssl.HostnameVerifier;
 import javax.net.ssl.SNIHostName;
 import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLException;
 import javax.net.ssl.SSLParameters;
 import javax.net.ssl.SSLSocket;
 import java.io.IOException;
@@ -87,7 +84,6 @@
 import java.net.URLEncoder;
 import java.net.UnknownHostException;
 import java.nio.charset.StandardCharsets;
-import java.security.NoSuchAlgorithmException;
 import java.util.Arrays;
 import java.util.Base64;
 import java.util.Collection;
@@ -133,7 +129,7 @@ public class HttpAPIClientHelper {
 
     LZ4Factory lz4Factory;
 
-    private final ClickHouseDefaultSslContextProvider sslContextProvider = new ClickHouseDefaultSslContextProvider();
+    private final SslContextProvider sslContextProvider = new SslContextProvider();
 
     public HttpAPIClientHelper(Map<String, Object> configuration, Object metricsRegistry, boolean initSslContext, LZ4Factory lz4Factory) {
         this.metricsRegistry = metricsRegistry;
@@ -161,56 +157,46 @@ public HttpAPIClientHelper(Map<String, Object> configuration, Object metricsRegi
      * @return SSLContext
      */
     public SSLContext createSSLContext(Map<String, Object> configuration) {
-        SSLContext sslContext;
-        try {
-            sslContext = SSLContext.getDefault();
-        } catch (NoSuchAlgorithmException e) {
-            throw new ClientException("Failed to create default SSL context", e);
-        }
         final SSLMode sslMode = ClientConfigProperties.SSL_MODE.getOrDefault(configuration);
         final String trustStorePath = (String) configuration.get(ClientConfigProperties.SSL_TRUST_STORE.getKey());
         final String caCertificate = (String) configuration.get(ClientConfigProperties.CA_CERTIFICATE.getKey());
         final String sslCertificate = (String) configuration.get(ClientConfigProperties.SSL_CERTIFICATE.getKey());
         final String sslKey = (String) configuration.get(ClientConfigProperties.SSL_KEY.getKey());
 
-        // This method is only reached when a secure (https) endpoint is configured, so SSLMode.Disabled
-        // contradicts the endpoint scheme. The mode does not turn encryption off - the scheme decides it.
-        if (sslMode == SSLMode.Disabled) {
-            throw new ClientMisconfigurationException("SSL mode '" + SSLMode.Disabled
-                    + "' cannot be used with a secure (https) endpoint. Use SSLMode.Trust to trust all certificates or use plain HTTP");
+        SslContextProvider.Builder builder = sslContextProvider.builder();
+
+        // The client certificate/key (mTLS) are independent of how the server certificate is verified,
+        // so they are applied whenever configured, regardless of the SSL mode.
+        if (sslCertificate != null && !sslCertificate.isEmpty()) {
+            builder.clientCertificate(sslCertificate, sslKey);
         }
 
-        if (sslMode == SSLMode.Trust) {
-            // Server certificate is not validated. Trust material (trust store or CA certificate)
-            // is not needed, but client certificate and key are still applied for mTLS.
-            try {
-                sslContext = sslContextProvider.getSslContextFromCerts(ClickHouseSslMode.NONE,
-                        sslCertificate, sslKey, null);
-            } catch (SSLException e) {
-                throw new ClientMisconfigurationException("Failed to create SSL context for the Trust SSL mode", e);
+        if (sslMode == SSLMode.TRUST) {
+            // TRUST accepts any server certificate and skips the hostname check (the latter is applied
+            // where the connection socket factory is created). A configured trust store or CA
+            // certificate has no effect in this mode and is ignored with a warning.
+            if (trustStorePath != null || caCertificate != null) {
+                LOG.warn("SSL mode '{}' trusts any server certificate; the configured {} is ignored.",
+                        SSLMode.TRUST, trustStorePath != null ? "trust store" : "CA certificate");
             }
+            builder.trustAllCertificates();
         } else if (trustStorePath != null) {
+            // VERIFY_CA / STRICT: validate against the trust store. A trust store and a CA certificate
+            // cannot both take effect, so the CA certificate is ignored with a warning.
             if (caCertificate != null) {
-                throw new ClientMisconfigurationException("CA certificate cannot be used together with a trust store."
-                        + " The CA certificate should be imported into the trust store instead.");
-            }
-            try {
-                sslContext = sslContextProvider.getSslContextFromKeyStore(
-                        trustStorePath,
-                        (String) configuration.get(ClientConfigProperties.SSL_KEY_STORE_PASSWORD.getKey()),
-                        (String) configuration.get(ClientConfigProperties.SSL_KEYSTORE_TYPE.getKey())
-                );
-            } catch (SSLException e) {
-                throw new ClientMisconfigurationException("Failed to create SSL context from a keystore", e);
-            }
-        } else if (caCertificate != null || sslCertificate != null|| sslKey != null) {
-            try {
-                sslContext = sslContextProvider.getSslContextFromCerts(sslCertificate, sslKey, caCertificate);
-            } catch (SSLException e) {
-                throw new ClientMisconfigurationException("Failed to create SSL context from certificates", e);
+                LOG.warn("Both a trust store and a CA certificate are configured; using the trust store and"
+                        + " ignoring the CA certificate. Import the CA certificate into the trust store instead.");
             }
+            builder.trustStore(trustStorePath,
+                    (String) configuration.get(ClientConfigProperties.SSL_KEY_STORE_PASSWORD.getKey()),
+                    (String) configuration.get(ClientConfigProperties.SSL_KEYSTORE_TYPE.getKey()));
+        } else if (caCertificate != null) {
+            // VERIFY_CA / STRICT: validate against the CA certificate.
+            builder.rootCertificate(caCertificate);
         }
-        return sslContext;
+        // else VERIFY_CA / STRICT with no trust material: the JVM default trust store is used.
+
+        return builder.build();
     }
 
     private static final long CONNECTION_INACTIVITY_CHECK = 5000L;
@@ -299,7 +285,7 @@ public CloseableHttpClient createHttpClient(boolean initSslContext, Map<String,
             SSLMode sslMode = ClientConfigProperties.SSL_MODE.getOrDefault(configuration);
             // Trust and VerifyCa skip hostname verification. The same applies when a custom SNI is
             // set because the connection hostname will not match the certificate.
-            boolean trustAllHostnames = sslMode == SSLMode.Trust || sslMode == SSLMode.VerifyCa;
+            boolean trustAllHostnames = sslMode == SSLMode.TRUST || sslMode == SSLMode.VERIFY_CA;
             if (socketSNI != null && !socketSNI.trim().isEmpty() || trustAllHostnames) {
                 sslConnectionSocketFactory = new CustomSSLConnectionFactory(socketSNI, sslContext, (hostname, session) -> true);
             } else {