[
https://issues.apache.org/jira/browse/FOP-3300?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18068954#comment-18068954
]
DaveLaw commented on FOP-3300:
------------------------------
Sorry, couldn't get back to you earlier.
Being a pensioner, my calendar is full !! :P
The Customer I wrote a FOP-Server for a couple of years back was kind enough to
forward yesterdays Daily Stats:
100,000 Invocations with an average (elapsed) duration of 70ms
And their Server does a _lot more_ than a couple of SAX transformations.
(eg. FOP, CUPS print, Javamail, Zip archive, ftp, Entire-X communication...)
And the Linux boxes they are using are not exactly high-end.
So in that context, 54ms to read the Keystore is pretty significant.
(ok, I guess that was not measured on a high-end box either)
There is also another, equally significant, issue:
the current implementation takes the first X509 Trust Chain it finds in the
Keystore & ignores the rest.
My (ex-)Customer already uses a Keystore for SOAP, so they might end up
having to use multiple Keystores, which could be bothersome.
I envisage, we could add a means of supplying the following to the FopFactory :
- the PrivateKey
- the Leaf X509 Certificate
- a Bouncy Castle JcaCertStore (which contains the Cert Trust Chain)
- Name, Location & Reason as at present
(or, instead of the JcaCertStore, the Cert Trust Chain, obviating exposure of
Bouncy Castle)
That would optimise the Signature as far as possible.
If you like, I could take a look at this...
> Extra Constructor for org.apache.fop.pdf.PDFSignParams?
> -------------------------------------------------------
>
> Key: FOP-3300
> URL: https://issues.apache.org/jira/browse/FOP-3300
> Project: FOP
> Issue Type: Improvement
> Components: renderer/pdf
> Affects Versions: 2.11
> Reporter: DaveLaw
> Assignee: Simon Steiner
> Priority: Minor
>
> I suspect org.apache.fop.pdf.PDFSignature is rather performance-hungry in a
> high-volume production environment.
> Would it be possible to add another Constructor to
> org.apache.fop.pdf.PDFSignParams,
> replacing the Keystore & its Password with a Supplier<Certificate[]> ?
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
