Skip to content

Handle multiple directories in SSL_CERT_DIR env variable#1697

Open
iiljkic wants to merge 3 commits intominio:masterfrom
iiljkic:handle-multiple-cert-dirs
Open

Handle multiple directories in SSL_CERT_DIR env variable#1697
iiljkic wants to merge 3 commits intominio:masterfrom
iiljkic:handle-multiple-cert-dirs

Conversation

@iiljkic
Copy link
Copy Markdown

@iiljkic iiljkic commented Apr 21, 2026

Description

Currently, the SSL_CERT_DIR environment variable is treated as a single directory path. However, this variable often contains multiple paths separated by the OS path separator. See the OpenSSL manual:

If any directories are named on the command line, then those are processed in turn. If not, then the SSL_CERT_DIR environment variable is consulted; this should be a colon-separated list of directories, like the Unix PATH variable. If that is not set then the default directory (installation-specific but often /usr/local/ssl/certs) is processed.
Reference: https://docs.openssl.org/3.1/man1/openssl-rehash/#synopsis

This PR updates the certificate loading logic to support multiple directories, ensuring broader compatibility with enterprise and containerized environments.

Changes Proposed

  • Split paths safely: The SSL_CERT_DIR string is now split using the OS-specific path separator (File.pathSeparator).
  • Process independently: Each directory is processed individually to load the certificates.

Testing Done

  • Verified that the code correctly parses multiple directories using OS-specific delimiters.
  • Verified that the code still correctly processes single directory variable values.
  • Verified that invalid or empty directory strings are gracefully ignored.
  • Ran ./gradlew :api:spotlessApply, ./gradlew build, and ./gradlew runFunctionalTest and confirmed everything still green.

Comment thread api/src/main/java/io/minio/Http.java Outdated
ks.setCertificateEntry(namePrefix + (certsInFile++), cert);
}
return index;
return certsInFile;
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You are just renaming variables here. I don't think it is needed.

Comment thread api/src/main/java/io/minio/Http.java Outdated
}

private static X509TrustManager getTrustManagerFromDir(String dirPath)
private static X509TrustManager getTrustManagerFromDirs(String dirPaths)
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I don't think we need to say paths. Just treat dirPath like PATH env var i.e. colon separated list of path. This applicable everywhere.

@iiljkic
Copy link
Copy Markdown
Author

iiljkic commented Apr 21, 2026

Reverted the renamings to keep the diff as small as possible

@iiljkic iiljkic requested a review from balamurugana April 21, 2026 11:27
Comment thread api/src/main/java/io/minio/Http.java Outdated
@iiljkic
Copy link
Copy Markdown
Author

iiljkic commented Apr 22, 2026

I removed the getDirectories() helper and inlined the path-splitting logic

Note: I assumed you meant to inline it inside getTrustManagerFromDir() rather than getTrustManagerFromFile()

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants