$ the-wire · showcase
Spring Boot SSL Reload Bug Exposed
By RepoJournal · Filed · About Spring · Composed from the cited sources · methodology
10 people shipped this
Mark Paluch
@mp911de
2 cited
Artem Bilan
@artembilan
2 cited
scottfrederick
@scottfrederick
1 cited
philsttr
@philsttr
1 cited
kalayciburak
@kalayciburak
1 cited
Jens Schauder
@schauder
Alexander Makarov
@MacAlsandair
Moritz Halbritter
@mhalbritter
Josh Cummings
@jzheaux
ZaheerAhmadDev
@ZaheerAhmadDev
If you reload an SSL bundle on Tomcat, you are silently dropping custom host configuration.
Spring Boot's SSL host config customizations are lost when reloading SSL bundles [1], a bug that can break SNI setups in production. Meanwhile, Micrometer Tracing gets configurable MDC keys, so you can use `trace_id`/`span_id` instead of `traceId`/`spanId` [2]. Spring Data Commons removes the warn logging about `@ProjectedPayload` params, signaling the migration is complete [3], and fixes nested `KPropertyPath` rendering with a new internal `NestedKPropertyPath` interface [4]. Spring Integration cuts UDP multicast test retries from 20 to 3, and then disables them entirely on Windows CI runners, because "neither of the previous two mitigations can tell a bad host from a good one" [5][6]. RestTemplate removal warnings are suppressed across Spring Integration until the client is removed [7].
Action items
- → Patch Spring Boot if you reload SSL bundles on Tomcat with custom SNI host configs spring-projects/spring-boot [immediate]
- → Review your MDC key expectations; the new Micrometer Tracing config may be relevant spring-projects/spring-boot [plan]
- → Update Spring Integration if you rely on UDP multicast tests in CI spring-projects/spring-integration [monitor]
References
- [1] SSL host config customizations are lost when reloading SSL bundles ↗ spring-projects/spring-boot
- [2] Allow configuring Micrometer Tracing MDC keys ↗ spring-projects/spring-boot
- [3] Remove the warn logging about params not annotated with `@ProjectedPayload`. ↗ spring-projects/spring-data-commons
- [4] Fix nested `KPropertyPath` rendering. ↗ spring-projects/spring-data-commons
- [5] Reduce the `@RetryingTest` budget for the UDP multicast tests ↗ spring-projects/spring-integration
- [6] Disable UDP multicast tests on Windows CI runners ↗ spring-projects/spring-integration
- [7] GH-11268: Suppress RestTemplate removal warnings ↗ spring-projects/spring-integration
