Skip to content

Handle multiple directories in SSL_CERT_DIR env variable#1697

Merged
harshavardhana merged 3 commits into
minio:masterfrom
iiljkic:handle-multiple-cert-dirs
May 19, 2026
Merged

Handle multiple directories in SSL_CERT_DIR env variable#1697
harshavardhana merged 3 commits into
minio:masterfrom
iiljkic:handle-multiple-cert-dirs

Conversation

@iiljkic
Copy link
Copy Markdown
Contributor

@iiljkic iiljkic commented Apr 21, 2026

Description

Currently, the SSL_CERT_DIR environment variable is treated as a single directory path. However, this variable often contains multiple paths separated by the OS path separator. See the OpenSSL manual:

If any directories are named on the command line, then those are processed in turn. If not, then the SSL_CERT_DIR environment variable is consulted; this should be a colon-separated list of directories, like the Unix PATH variable. If that is not set then the default directory (installation-specific but often /usr/local/ssl/certs) is processed.
Reference: https://docs.openssl.org/3.1/man1/openssl-rehash/#synopsis

This PR updates the certificate loading logic to support multiple directories, ensuring broader compatibility with enterprise and containerized environments.

Changes Proposed

  • Split paths safely: The SSL_CERT_DIR string is now split using the OS-specific path separator (File.pathSeparator).
  • Process independently: Each directory is processed individually to load the certificates.

Testing Done

  • Verified that the code correctly parses multiple directories using OS-specific delimiters.
  • Verified that the code still correctly processes single directory variable values.
  • Verified that invalid or empty directory strings are gracefully ignored.
  • Ran ./gradlew :api:spotlessApply, ./gradlew build, and ./gradlew runFunctionalTest and confirmed everything still green.

Comment thread api/src/main/java/io/minio/Http.java Outdated
Comment thread api/src/main/java/io/minio/Http.java Outdated
@iiljkic
Copy link
Copy Markdown
Contributor Author

iiljkic commented Apr 21, 2026

Reverted the renamings to keep the diff as small as possible

@iiljkic iiljkic requested a review from balamurugana April 21, 2026 11:27
Comment thread api/src/main/java/io/minio/Http.java Outdated
@iiljkic
Copy link
Copy Markdown
Contributor Author

iiljkic commented Apr 22, 2026

I removed the getDirectories() helper and inlined the path-splitting logic

Note: I assumed you meant to inline it inside getTrustManagerFromDir() rather than getTrustManagerFromFile()

@harshavardhana harshavardhana merged commit d1961d4 into minio:master May 19, 2026
8 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants