maven plugin swagger-codegen-maven-plugin issue

Question

I'm trying to change the default protocol of ApiClient generated by codegen from TLS to TLSv1.2. I'm using swagger-codegen-maven-plugin. Is there any property I could use in my pom.xml? I tryed to use -Dhttps.protocols=TLSv1.2 in maven command line but no success.

Generated default ApiClient:

...
private void applySslSettings() {
        try {
            TrustManager[] trustManagers = null;
            HostnameVerifier hostnameVerifier = null;
            if (!verifyingSsl) {
                TrustManager trustAll = new X509TrustManager() {
                    @Override
                    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
                    @Override
                    public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {}
                    @Override
                    public X509Certificate[] getAcceptedIssuers() { return null; }
                };
                SSLContext sslContext = SSLContext.getInstance("TLS");
                trustManagers = new TrustManager[]{ trustAll };
    ...

pom.xml:

<plugin>
                <groupId>io.swagger.codegen.v3</groupId>
                <artifactId>swagger-codegen-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <goals>
                            <goal>generate</goal>
                        </goals>
                        <configuration>
                            <inputSpec>${project.basedir}/src/main/resources/admin.yaml</inputSpec>
                            <output>${generation.path}</output>
                            <language>java</language>
                            <addCompileSourceRoot>false</addCompileSourceRoot>
                            <generateApiTests>false</generateApiTests>
                            <generateApiDocumentation>false</generateApiDocumentation>
                            <generateModelTests>false</generateModelTests>
                            <generateModelDocumentation>false</generateModelDocumentation>
                            <configOptions>
                                <dateLibrary>joda</dateLibrary>
                                <modelPackage>${codegen.model}</modelPackage>
                                <apiPackage>${codegen.api}</apiPackage>
                                <configPackage>${codegen.configuration}</configPackage>
                                <basePackage>${codegen.base}</basePackage>
                            </configOptions>
                        </configuration>
                    </execution>
                </executions>
   </plugin>

I read the docs but I didn't find any clue: https://github.com/swagger-api/swagger-codegen/blob/master/modules/swagger-codegen-maven-plugin/README.md

Configs: Java 11, swagger-codegen-maven-plugin v3.0.33

Answer 1

I found a way to use TLSv1.2 by changing the template.

You can get the template from OpenAPITools

• If you need to alter the java client, get the "Java" folder (my case)
• If you need to alter the server and using spring, you'll propably need JavaSpring (not my case)
• In order to change the TLS you might go to the libraries sub-folder and find the right client you are using (Default is okhttp-gson). There you will find ApiClient.mustache
• Copy that file to your resource folder src/main/resource/custom-template/libraries/okhttp-gson. You can customize the name of custom-template but the rest needs to be exactly like this
• Open ApiClient.mustache and change the line SSLContext sslContext = SSLContext.getInstance("TLS"); to SSLContext sslContext = SSLContext.getInstance("TLSv1.2");
• Go to your maven plugin and change the plugin like that:

<plugin>
    <groupId>org.openapitools</groupId>
    <artifactId>openapi-generator-maven-plugin</artifactId>
    ...
    <executions>
        <execution>
            <configuration>
                <templateResourcePath>src/main/resources/custom-template</templateResourcePath>
                ...
            </configuration>
            ...
        </execution>
    </executions>
</plugin>

• After that, I was able to generate a client that uses TLSv1.2
• Note: As far as I know the client does not really decide what protocoll is used when communicating. This is something the server has to force. I still needed that change to sooth the security scans in my project