SpringCloud/spring-cloud-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Add ability to configure client TLS enabled protocol versions and cipher suites via Spring properties.

Browse Source 
Closes gh-581.
This commit is contained in:
Mark Paluch
2021-03-16 16:13:37 +01:00
parent f596d2c55c
commit e337be70e1
5 changed files with 55 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
docs/src/main/asciidoc/_configprops.adoc
View File

@@ -123,6 +123,8 @@
|spring.cloud.vault.session.lifecycle.expiry-threshold | `7s` | The expiry threshold for a {@link LoginToken}. The threshold represents a minimum TTL duration to consider a login token as valid. Tokens with a shorter TTL are considered expired and are not used anymore. Should be greater than {@code refreshBeforeExpiry} to prevent token expiry.
|spring.cloud.vault.session.lifecycle.refresh-before-expiry | `5s` | The time period that is at least required before renewing the {@link LoginToken}.
|spring.cloud.vault.ssl.cert-auth-path | `cert` | Mount path of the TLS cert authentication backend.
|spring.cloud.vault.ssl.enabled-cipher-suites | | List of enabled SSL/TLS cipher suites. @since 3.0.2
|spring.cloud.vault.ssl.enabled-protocols | | List of enabled SSL/TLS protocol. @since 3.0.2
|spring.cloud.vault.ssl.key-store | | Trust store that holds certificates and private keys.
|spring.cloud.vault.ssl.key-store-password | | Password used to access the key store.
|spring.cloud.vault.ssl.key-store-type | | Type of the key store. @since 3.0

4
docs/src/main/asciidoc/other-topics.adoc
View File

@@ -71,6 +71,8 @@ spring.cloud.vault:
trust-store: classpath:keystore.jks
trust-store-password: changeit
trust-store-type: JKS
enabled-protocols: TLSv1.2,TLSv1.3
enabled-cipher-suites: TLS_AES_128_GCM_SHA256
----
====
@@ -78,6 +80,8 @@ spring.cloud.vault:
SSL-secured Vault communication will validate the Vault SSL certificate with the specified trust-store.
* `trust-store-password` sets the trust-store password
* `trust-store-type` sets the trust-store type. Supported values are all supported `KeyStore` types including `PEM`.
* `enabled-protocols` sets the list of enabled SSL/TLS protocols (since 3.0.2).
* `enabled-cipher-suites` sets the list of enabled SSL/TLS cipher suites (since 3.0.2).
Please note that configuring `spring.cloud.vault.ssl.*` can be only applied when either Apache Http Components or the OkHttp client is on your class-path.