Wiring HTTP client security in Spring

[Cantor, Scott]

> That's probably true. Both of the existing HTTP metadata providers (batch
> and dynamic) can take either a full TLSTrustEngine child element, or a
> tlsTrustEngineRef to a bean, but I don't think we have any shortcut for the
> single-certificate case.    The easiest way I can see would be via the ref, with a
> FactoryBean for ExplicitKeyTrustEngine that we are discussing.  I guess could
> also add a certificate attribute somewhere or something, although that
> means we then have 3 different ways to do the same thing, which maybe
> starts to get a little confusing for the user...

It is but that's complexity for us more than the user. 99% of people would use one of the certificate attributes. 1% might bother to do something fancier and need the bean. The inline TrustEngine stuff is more legacy.

> But I thought we didn't want to promote PKIX anymore?  Or is this different,
> since we're talking about TLS, not XML signatures, etc.?

Yes, I'm talking TLS against a known endpoint, not something driven by metadata. TLS is also more vulnerable to attacks against the key online so using a long term key in that spot isn't wise.

-- Scott