Ephemeral CA + per-host leaf minting for the egress proxy's TLS-terminating (MITM) tier — the piece that gives a jailed shell child GET-not-POST fidelity over HTTPS, matching what the interpreter method-guard already does pre-TLS.
Why it exists: a plain CONNECT proxy only sees CONNECT host:443 — the method
and path live inside the TLS the proxy never opens, so HTTPS verb/path is
opaque. To read them the proxy must TERMINATE the child's TLS: present the
child a leaf cert for the requested host, decrypt, inspect method+path, then
re-encrypt to the real upstream (whose real cert the proxy still validates).
Trust model:
CURL_CA_BUNDLE/SSL_CERT_FILE
/REQUESTS_CA_BUNDLE/NODE_EXTRA_CA_CERTS/GIT_SSL_CAINFO). Only children
inside the jail ever see or trust it.No JCA provider is registered globally: bcpkix's Jca* builders use the default platform signer (SHA256withRSA via SunRsaSign), which keeps this native-image friendly and side-effect free.
Ephemeral CA + per-host leaf minting for the egress proxy's TLS-terminating
(MITM) tier — the piece that gives a jailed shell child GET-not-POST fidelity
over HTTPS, matching what the interpreter method-guard already does pre-TLS.
Why it exists: a plain CONNECT proxy only sees `CONNECT host:443` — the method
and path live inside the TLS the proxy never opens, so HTTPS verb/path is
opaque. To read them the proxy must TERMINATE the child's TLS: present the
child a leaf cert for the requested host, decrypt, inspect method+path, then
re-encrypt to the real upstream (whose real cert the proxy still validates).
Trust model:
- The CA is EPHEMERAL and per-session — born in this JVM, never written to
the host trust store. Its cert PEM is written to a temp file whose path is
injected into the jailed child's trust env (`CURL_CA_BUNDLE`/`SSL_CERT_FILE`
/`REQUESTS_CA_BUNDLE`/`NODE_EXTRA_CA_CERTS`/`GIT_SSL_CAINFO`). Only children
inside the jail ever see or trust it.
- Upstream (proxy -> real server) uses the SYSTEM trust store by default, so
the real server's real certificate is still validated end to end.
No JCA provider is registered globally: bcpkix's Jca* builders use the default
platform signer (SHA256withRSA via SunRsaSign), which keeps this native-image
friendly and side-effect free.(create!)(create! {:keys [upstream-trust-all?]})Build the gateway MITM capability. Returns a map: :ca-cert ephemeral CA certificate :ca-file CA PEM for curl/Python/Bun trust env :java-trust-store PKCS12 path for managed JVM children :java-trust-store-password random password for that ephemeral store :ctx-for (fn [host] -> server SSLContext), cached per host :upstream-factory proxy->real-server SSLSocketFactory :close! delete both ephemeral trust files
Options: :upstream-trust-all? (TEST) swaps upstream validation for trust-all.
Build the gateway MITM capability. Returns a map: :ca-cert ephemeral CA certificate :ca-file CA PEM for curl/Python/Bun trust env :java-trust-store PKCS12 path for managed JVM children :java-trust-store-password random password for that ephemeral store :ctx-for (fn [host] -> server SSLContext), cached per host :upstream-factory proxy->real-server SSLSocketFactory :close! delete both ephemeral trust files Options: `:upstream-trust-all?` (TEST) swaps upstream validation for trust-all.
(gen-ca)Mint a self-signed CA certificate + its key pair (in memory only).
Mint a self-signed CA certificate + its key pair (in memory only).
cljdoc builds & hosts documentation for Clojure/Script libraries
| Ctrl+k | Jump to recent docs |
| ← | Move to previous article |
| → | Move to next article |
| Ctrl+/ | Jump to the search field |