From 89ef16c48d4b2ce45bdb33fb789edb3dd74e2e85 Mon Sep 17 00:00:00 2001
From: tallison <tallison@apache.org>
Date: Wed, 29 Jul 2026 15:54:14 -0400
Subject: [PATCH] simplify tls

---
 .../modules/ROOT/pages/using-tika/grpc/index.adoc |  9 +++++----
 .../apache/tika/pipes/grpc/TikaGrpcServer.java    | 11 ++++++-----
 .../tika/pipes/grpc/TikaGrpcServerTlsTest.java    | 15 ++++++++++++---
 3 files changed, 23 insertions(+), 12 deletions(-)

diff --git a/docs/modules/ROOT/pages/using-tika/grpc/index.adoc b/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
index ef550e0e24..ab58eec64d 100644
--- a/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
+++ b/docs/modules/ROOT/pages/using-tika/grpc/index.adoc
@@ -126,10 +126,11 @@ java -jar tika-grpc-<version>.jar --secure \
   --trust-cert-collection ca.pem --client-auth-required
 ----
 
-Mutual TLS is opt-in: `--client-auth-required` is off by default, so it has no
-effect unless `--trust-cert-collection` is also given (a missing or non-existent
-trust-collection path is silently ignored). The default port is `50052`
-(`-p`/`--port`).
+`--client-auth-required` implies `--secure` -- it's included above for clarity,
+but TLS is enabled automatically whenever client authentication is required.
+`--trust-cert-collection` must point to a readable file when
+`--client-auth-required` is set; the server refuses to start otherwise. The
+default port is `50052` (`-p`/`--port`).
 
 When running the Docker image, append these flags to the container command — they
 are forwarded to the server — and mount the certificate files into the container.
diff --git a/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java b/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
index 79f64ea539..f55b5bac1b 100644
--- a/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
+++ b/tika-grpc/src/main/java/org/apache/tika/pipes/grpc/TikaGrpcServer.java
@@ -70,10 +70,10 @@ public class TikaGrpcServer {
     @Parameter(names = {"--private-key-password"}, description = "Private key password, if needed")
     private String privateKeyPassword;
 
-    @Parameter(names = {"--trust-cert-collection"}, description = "The trust certificate collection (root certs). Example: ca.pem See: https://github.com/grpc/grpc-java/tree/b3ffb5078df361d7460786e134db7b5c00939246/examples/example-tls")
+    @Parameter(names = {"--trust-cert-collection"}, description = "The trust certificate collection (root certs). Required, and must be a readable file, when --client-auth-required is set. Example: ca.pem See: https://github.com/grpc/grpc-java/tree/b3ffb5078df361d7460786e134db7b5c00939246/examples/example-tls")
     private File trustCertCollection;
 
-    @Parameter(names = {"--client-auth-required"}, description = "Is Mutual TLS required?")
+    @Parameter(names = {"--client-auth-required"}, description = "Is Mutual TLS required? Implies --secure.")
     private boolean clientAuthRequired;
 
     @Parameter(names = {"-h", "-H", "--help"}, description = "Display help menu")
@@ -82,6 +82,10 @@ public class TikaGrpcServer {
     public void start() throws Exception {
         HealthStatusManager healthStatusManager = new HealthStatusManager();
         ServerCredentials creds;
+        if (clientAuthRequired && !secure) {
+            LOGGER.info("--client-auth-required implies --secure; enabling TLS.");
+            secure = true;
+        }
         if (secure) {
             TlsServerCredentials.Builder channelCredBuilder = TlsServerCredentials.newBuilder();
             channelCredBuilder.keyManager(certChain, privateKey, privateKeyPassword);
@@ -97,9 +101,6 @@ public void start() throws Exception {
             }
             creds = channelCredBuilder.build();
         } else {
-            if (clientAuthRequired) {
-                throw new IllegalArgumentException("--client-auth-required requires --secure; refusing to start");
-            }
             creds = InsecureServerCredentials.create();
         }
         if (tikaConfig == null) {
diff --git a/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java b/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
index d6edd326e7..71390d1ca9 100644
--- a/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
+++ b/tika-grpc/src/test/java/org/apache/tika/pipes/grpc/TikaGrpcServerTlsTest.java
@@ -30,7 +30,8 @@
 /**
  * Covers the trust-cert-collection states that {@link TikaGrpcServer#start()} should refuse
  * to start on when {@code --client-auth-required} is set: omitted, nonexistent, unreadable,
- * and invalid/corrupt content, plus {@code --client-auth-required} without {@code --secure}.
+ * and invalid/corrupt content. Also covers {@code --client-auth-required} without
+ * {@code --secure}, which implies {@code --secure} rather than being rejected.
  */
 class TikaGrpcServerTlsTest {
     private static final File CERT_CHAIN = Paths.get("src", "test", "resources", "certs", "server1.pem").toFile();
@@ -38,11 +39,19 @@ class TikaGrpcServerTlsTest {
     private static final File VALID_TRUST_COLLECTION = Paths.get("src", "test", "resources", "certs", "ca.pem").toFile();
 
     @Test
-    void clientAuthRequiredWithoutSecureRefusesToStart() {
+    void clientAuthRequiredWithoutSecureImpliesSecureAndStarts() throws Exception {
         TikaGrpcServer server = new TikaGrpcServer()
+                .setPort(0)
                 .setSecure(false)
+                .setCertChain(CERT_CHAIN)
+                .setPrivateKey(PRIVATE_KEY)
+                .setTrustCertCollection(VALID_TRUST_COLLECTION)
                 .setClientAuthRequired(true);
-        assertThrows(IllegalArgumentException.class, server::start);
+        try {
+            server.start();
+        } finally {
+            server.stop();
+        }
     }
 
     @Test