Wiring HTTP client security in Spring

[Brent Putman]

On 10/24/16 12:14 PM, Cantor, Scott wrote:
>> TLS on the MDQ server could span a range of options:
>>
>> 1) CA-signed TLS certificate rooted in a commercial CA
>> 2) Self-signed TLS certificate
>> 3) CA-signed TLS certificate rooted in a private CA
>>
>> All else being equal, I personally prefer #3 but the characteristics
>> of the deployment will determine the optimal choice.
> Right, and ideally all of them should be configured with essentially one declaration of a certificate (either the end entity or the CA(s)).

As long as you know which you have (end-entity or CA), I'd think that's
achievable with a factory bean.  #1 and #3 are essentially the same I
think if you wire our PKIX trust engine with explicit roots.  If you
want #1 to be "any commerical CA trusted by the JVM" as some people
might expect, then that's different, that's not our TrustEngine approach.