SSL Certificates input as string #2873
Merged
Merged
Conversation
|
Repository collaborators can run the JMH benchmark suite against this PR by commenting: Optional regression threshold override (Δ% on Time or Alloc/op; defaults to 10%): Only one benchmark run per PR is active at a time — issuing a new |
Client V2 CoverageCoverage Report
Class Coverage
|
JDBC V2 CoverageCoverage Report
Class Coverage
|
JDBC V1 CoverageCoverage Report
Class Coverage
|
Client V1 CoverageCoverage Report
Class Coverage
|
Contributor
Author
|
@cursor review |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
✅ Bugbot reviewed your changes and found no new issues!
Comment @cursor review or bugbot run to trigger another review on this PR
Reviewed by Cursor Bugbot for commit 2516d01. Configure here.
There was a problem hiding this comment.
Pull request overview
Adds support for supplying TLS certificates/keys as inline PEM strings (in addition to file paths), enabling safer usage in environments like Kubernetes where secrets are commonly injected via environment variables and writable disk may be unavailable.
Changes:
- Extend
ClickHouseDefaultSslContextProviderto detect inline PEM content (-----BEGIN ...) and open it as anInputStream, reusing the same mechanism for private keys and certificate/key store creation. - Update JDBC and Client-v2 SSL examples to demonstrate passing the root CA certificate as a PEM string.
- Enable the Client-v2 integration test variant that passes the custom CA certificate as a PEM string.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| examples/jdbc/src/main/java/com/clickhouse/examples/jdbc/SSLExamples.java | Adds a JDBC example showing sslrootcert provided as inline PEM content. |
| examples/client-v2/src/main/java/com/clickhouse/examples/client_v2/SSLExamples.java | Adds a Client-v2 example showing setRootCertificate() provided as inline PEM content. |
| client-v2/src/test/java/com/clickhouse/client/HttpTransportTests.java | Enables the existing integration-test branch for CA certificate passed as a string. |
| clickhouse-client/src/test/java/com/clickhouse/client/config/ClickHouseDefaultSslContextProviderTest.java | Adds unit tests for PEM-vs-path input stream handling and keystore/private key creation from PEM content. |
| clickhouse-client/src/main/java/com/clickhouse/client/config/ClickHouseDefaultSslContextProvider.java | Implements PEM-string detection and stream creation; wires it into private key and keystore loading. |
mshustov
approved these changes
Jun 15, 2026
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Client has support of SSL certificates and keys passed as path to file. This PR adds support of certificates passed as plain string.
This change allows more safely and easier to use client in k8s environment secrets are passed as env. variables and no writable disk so not possible to create a tmp file with certificate.
Along the changes examples for jdbc and client are added.
Checklist
Delete items not relevant to your PR:
Note
Medium Risk
Changes TLS trust/material parsing in a security-sensitive path, though behavior for file paths is preserved and PEM detection is narrow; misclassification of a path containing
-----BEGINis unlikely but would break file resolution.Overview
SSL certificate, root CA, and private key settings can now be supplied as inline PEM text as well as file paths.
ClickHouseDefaultSslContextProvideraddsgetCertificateInputStream: if the value contains-----BEGIN, it is read from memory; otherwise behavior is unchanged (classpath/home/file path).That path is wired through private key and keystore loading, so JDBC
sslrootcert/ client cert+key and Client v2setRootCertificate(and related mTLS settings) work with env vars or secrets without writing temp files.Tests and docs: unit coverage for PEM vs path; integration test
testCustomCaCertificatenow runs with CA passed as a string; JDBC and Client-v2SSLExamplesdemonstrate PEM-string root CA usage.Reviewed by Cursor Bugbot for commit d49e274. Bugbot is set up for automated code reviews on this repo. Configure here.