Named HTTP client ignores SSL settings

[martina-radilova-flowpay]

Hi,
after upgrading to Micronaut 4.10.3, I tried to configure a custom JdkHttpClient with an SSL context using application configuration like this:

micronaut:
  http:
    services:
      clientname:
        url: ${MFS_API}
        read-timeout: 300s
        ssl:
          enabled: true
          key-store:
            path: base64:${MFS-CERT}
            password: "password"
            type: PKCS12

However, this configuration does not work.
While investigating, I noticed that SSL is only applied when the configuration is an instance of ClientSslConfiguration, but named HTTP client configurations are wrapped inside ServiceHttpClientConfiguration.

In io.micronaut.http.client.jdk.AbstractJdkHttpClient, the constructor contains:

if (configuration.getSslConfiguration() instanceof ClientSslConfiguration clientSslConfiguration) {
    configureSsl(builder, clientSslConfiguration);
}

To make it work, I had to configure the client programmatically:

@Factory
public class XYHttpClientFactory {

    private static final String BASE_64_PREFIX = "base64:";
    private static final String KEY_TYPE_PKCS12 = "PKCS12";

    @Bean(preDestroy = "close")
    @Singleton
    @Named("xy")
    JdkHttpClient xyHttpClient(
            @Value("${app.xy.api}") String baseUrl,
            @Value("${app.xy.cert-file}") String certBase64,
            @Value("${app.xy.cert-pwd}") String certPassword
    ) {
        return createJdkHttpClientWithSsl(baseUrl, certBase64, certPassword);
    }

    public static JdkHttpClient createJdkHttpClientWithSsl(String baseUrl, String certBase64, String certPassword) {
        try {
            var httpClientConfiguration = getDefaultHttpClientConfiguration(certBase64, certPassword);

            var conversionService = ConversionService.SHARED;

            return new DefaultJdkHttpClient(
                    LoadBalancer.fixed(URI.create(baseUrl)),
                    null,
                    httpClientConfiguration,
                    null,
                    null,
                    null,
                    null,
                    JdkHttpClientFactory.createDefaultMessageBodyHandlerRegistry(),
                    null,
                    null,
                    conversionService,
                    new JdkClientSslBuilder(new ResourceResolver()),
                    new NettyCookieDecoder(conversionService));
        } catch (Exception e) {
            throw new RuntimeException("Failed to create HTTP client with SSL", e);
        }
    }

    private static DefaultHttpClientConfiguration getDefaultHttpClientConfiguration(String certBase64, String certPassword) {
        var keyStore = new ClientSslConfiguration.DefaultKeyStoreConfiguration();
        keyStore.setPath(BASE_64_PREFIX + certBase64);
        keyStore.setPassword(certPassword);
        keyStore.setType(KEY_TYPE_PKCS12);

        var sslConfiguration = new ClientSslConfiguration();
        sslConfiguration.setKeyStore(keyStore);
        var httpClientConfiguration = new DefaultHttpClientConfiguration();
        httpClientConfiguration.setClientSslConfiguration(sslConfiguration);
        return httpClientConfiguration;
    }
}

Questions

1. Is there a better or recommended way to configure SSL for a named JDK HTTP client?
2. Why is it not possible to configure the SSL context for named HTTP clients via the application.yml?

Thanks!

[khurramijaz]

Please check extra indentation below services. Its working fine here.

[martina-radilova-flowpay]

Please check extra indentation below services. Its working fine here.

I've corrected the issue report. I used the correct indentation – IDEA would indicate if it was incorrect and the app would fail during initialization. I didn’t receive any errors; I only noticed that no SSL was set during debugging and in the logs enabled by this setting in build.gradle:

test {
    systemProperty "javax.net.debug", "ssl,handshake"
}

Is it working for you with a named client? Could you post your configuration here?