CODEWITHSUNDEEP
springspring-boot
Harry
Harry

Reputation: 505

Will spring RestTemplate checks certificate revocation status

Could you please let me know by default whether the spring RestTemplate do certificate revocation status check? If yes, which one it does CRL or OCSP? or If I do the JVM settings it will take as per the JVM settings.

I am not able to find it from any documentation.

I use spring-boot 1.3.5

Upvotes: 1

Views: 831

Answers (1)

daniel.eichten
daniel.eichten

Reputation: 2555

This is not easy to answer cause RestTemplate is using a ClientHttpRequestFactory to create Requests which will then be executed. The default one which is being used is SimpleClientHttpRequestFactory that uses JDK internals and should let you manipulate its behavior by passing in JVM settings. I'm not aware of the details of the JVM but I think you can configure if it should check CRL, OCSP or both as well as some other things.

But if you are using a different one like Netty4ClientHttppRequestFactory, HttpComponentsClientHttpRequestFactory or OkHttp3ClientHttpRequestFactory the behavior might be different cause the implementation behind might be a different one. In these cases I suggest you have a look at the documentation of those projects.

Hope that helps.

Upvotes: 1

Related Questions