Add SSL bundle support to Cassandra auto-configuration

[suvanakar]

I am trying to connect to Cassandra from my Spring boot application using spring-boot-data-cassandra:3.1.3 and spring-boot-autoconfigure:2.4.2.

My Cassandra cluster is enabled with ssl at Cassandra side. So when I am auto configuring Cassandra connections with ssl enabled (by setting spring.data.cassandra.ssl=true) then Default SSL context is created for me, but i need to provide my truststore path and truststore password to initialize SSLContext. There is no properties provided at data-cassandra like the one provided for kafka(spring.kafka.ssl.truststore-location= # Location of the trust store file. spring.kafka.ssl.truststore-password= # Store password for the trust store file.), so is there any way to provide truststore file location and password to AutoConfigure my Cassandra configuration or to override default SSLContext created for the specified versions.

[wilkinsona]

You can use a CqlSessionBuilderCustomizer to configure the CqlSessionBuilder's SSLContext to meet your needs. I think it makes sense to add some properties for configuring a trust store and password. That could be done as part of #17589 or here with a specific focus on Cassandra. Let's see what the rest of the team thinks.

[suvanakar]

Thanks for the response @wilkinsona. But I strongly feel that the properties for such configurations should be provided to have a unified solution like we have for kafka for instance. Let's wait for the team to share their views.

[mbhave]

#17589 might mean that we unify ssl properties that we've got across the board to provide more cohesive support. It looks like it might be Spring Boot 3.0 work. We probably wouldn't want to add properties right now knowing they could go away in an upcoming release. Given that there is a customizer available, I think we should wait until we decide what to do with #17589.

[suvanakar]

@mbhave @wilkinsona I tried updating the SSLContext using CqlSessionBuilderCustomizer by creating a @Bean for the same like below. But this one is not working.

@Bean
public CqlSessionBuilderCustomizer cqlSessionBuilderCustomizer() {
    return cqlSessionBuilder -> cqlSessionBuilder
            .withSslContext(getCustomSslContext());
}

It is still taking the default SSLContext only. Any idea why is that?

[wilkinsona]

I can't explain why that would happen. CqlSessionBuilderCustomizer beans should be applied after the auto-configured has configured SSL, allowing them to override whatever the auto-configuration has done. If you provide a small sample that illustrates what you're trying to do, we can take a closer look.

[mkumar87]

@mbhave @wilkinsona I tried updating the SSLContext using CqlSessionBuilderCustomizer by creating a @Bean for the same like below. But this one is not working.

@Bean
public CqlSessionBuilderCustomizer cqlSessionBuilderCustomizer() {
    return cqlSessionBuilder -> cqlSessionBuilder
            .withSslContext(getCustomSslContext());
}

It is still taking the default SSLContext only. Any idea why is that?

I'm also facing similar issue and stuck here.. While debugging, I dont see the bean is initialized and getCustomSSLContext() is called at all