Wiring HTTP client security in Spring

[Tom Scavo]

On Mon, Oct 24, 2016 at 11:48 AM, Cantor, Scott <cantor.2 at osu.edu> wrote:
>> I'll observe that most of that is actually the ExplicitKeyTrustEngine, and wiring
>> up a static instance like that with static creds is kind of a special case.
>
> It is not the norm for the SOAP client, and I appreciate that the complexity was built around handling that use case, we just have to cook up some helpers to scale it back for the rest of the use cases.
>
> This is the same as the typical case with metadata in fact, but I don't think we have any support at the moment for wiring in a simple certificate check for the TLS connection, just for the signature filter.
>
> That's actually an issue I suppose, since MDQ will probably involve just a simple certificate check.

TLS on the MDQ server could span a range of options:

1) CA-signed TLS certificate rooted in a commercial CA
2) Self-signed TLS certificate
3) CA-signed TLS certificate rooted in a private CA

All else being equal, I personally prefer #3 but the characteristics
of the deployment will determine the optimal choice.

Tom