This is an automated email from the ASF dual-hosted git repository.
davsclaus pushed a commit to branch camel-4.22.x
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/camel-4.22.x by this push:
new d10872c5feb5 [camel-4.22.x] CAMEL-25890: camel-ftp - document how to
enable FTPS host name verification (#28188)
d10872c5feb5 is described below
commit d10872c5feb53b64e8177253658d06fa0f56328e
Author: Federico Mariani <[email protected]>
AuthorDate: Wed Oct 21 12:54:42 2026 +0200
[camel-4.22.x] CAMEL-25890: camel-ftp - document how to enable FTPS host
name verification (#28188)
Adds an "FTPS host name verification" section to the ftp component docs that
explains how to enable the check on this line with
ftpClient.endpointCheckingEnabled=true together with trust material, and
notes
that from Camel 4.24 the check is enabled by default with the
hostnameVerification option (#28186).
---
.../org/apache/camel/catalog/docs/ftp-component.adoc | 20 ++++++++++++++++++++
.../camel-ftp/src/main/docs/ftp-component.adoc | 20 ++++++++++++++++++++
2 files changed, 40 insertions(+)
diff --git
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/ftp-component.adoc
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/ftp-component.adoc
index c04925ac5732..34423c3fcde4 100644
---
a/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/ftp-component.adoc
+++
b/catalog/camel-catalog/src/generated/resources/org/apache/camel/catalog/docs/ftp-component.adoc
@@ -80,6 +80,26 @@ include::partial$component-endpoint-headers.adoc[]
== Usage
+=== FTPS host name verification
+
+The FTPS client that Camel creates does not check that the certificate of the
server matches the host of the endpoint:
+any certificate accepted by the trust manager is accepted, whatever host it
was issued for. To enable the check, set
+`ftpClient.endpointCheckingEnabled=true` on the endpoint. The check is done on
the control connection, during the TLS
+handshake and before login; data connections (`PROT P`) are not checked by
host name. It uses the same rules as an
+HTTPS client, so a connection to an IP address needs a certificate that lists
that address as a subject alternative
+name.
+
+Configure the trust material as well, with `sslContextParameters` or with the
`ftpClient.trustStore.*` options (see
+below), so that only certificates you trust are accepted:
+
+[source,text]
+----
+ftps://[email protected]/inbox?password=secret&sslContextParameters=#sslContextParameters&ftpClient.endpointCheckingEnabled=true
+----
+
+From Camel 4.24 onwards the check is enabled by default and controlled by the
`hostnameVerification` option; on
+earlier versions, use `ftpClient.endpointCheckingEnabled=true` as shown above.
+
=== FTPS component default trust store
When using the `ftpClient.` properties related to SSL with the FTPS
diff --git a/components/camel-ftp/src/main/docs/ftp-component.adoc
b/components/camel-ftp/src/main/docs/ftp-component.adoc
index c04925ac5732..34423c3fcde4 100644
--- a/components/camel-ftp/src/main/docs/ftp-component.adoc
+++ b/components/camel-ftp/src/main/docs/ftp-component.adoc
@@ -80,6 +80,26 @@ include::partial$component-endpoint-headers.adoc[]
== Usage
+=== FTPS host name verification
+
+The FTPS client that Camel creates does not check that the certificate of the
server matches the host of the endpoint:
+any certificate accepted by the trust manager is accepted, whatever host it
was issued for. To enable the check, set
+`ftpClient.endpointCheckingEnabled=true` on the endpoint. The check is done on
the control connection, during the TLS
+handshake and before login; data connections (`PROT P`) are not checked by
host name. It uses the same rules as an
+HTTPS client, so a connection to an IP address needs a certificate that lists
that address as a subject alternative
+name.
+
+Configure the trust material as well, with `sslContextParameters` or with the
`ftpClient.trustStore.*` options (see
+below), so that only certificates you trust are accepted:
+
+[source,text]
+----
+ftps://[email protected]/inbox?password=secret&sslContextParameters=#sslContextParameters&ftpClient.endpointCheckingEnabled=true
+----
+
+From Camel 4.24 onwards the check is enabled by default and controlled by the
`hostnameVerification` option; on
+earlier versions, use `ftpClient.endpointCheckingEnabled=true` as shown above.
+
=== FTPS component default trust store
When using the `ftpClient.` properties related to SSL with the FTPS
