From 520ad4762d658532e148b20bb112ab192cf604da Mon Sep 17 00:00:00 2001
From: ZhangJian He <shoothzj@gmail.com>
Date: Mon, 20 Mar 2023 16:19:10 +0800
Subject: [PATCH] add cert

---
 .../github/protocol/pulsar/TlsClientTest.java |  30 ++++++++
 .../pulsar/TlsClientWrongHostTest.java        |  66 ++++++++++++++++++
 src/test/resources/gen_jks_wrong_host.sh      |  38 ++++++++++
 .../pulsar_client_key_wrong_host.jks          | Bin 0 -> 2694 bytes
 .../pulsar_client_trust_wrong_host.jks        | Bin 0 -> 1222 bytes
 .../pulsar_server_key_wrong_host.jks          | Bin 0 -> 2694 bytes
 .../pulsar_server_trust_wrong_host.jks        | Bin 0 -> 1222 bytes
 7 files changed, 134 insertions(+)
 create mode 100644 src/test/java/io/github/protocol/pulsar/TlsClientWrongHostTest.java
 create mode 100644 src/test/resources/gen_jks_wrong_host.sh
 create mode 100644 src/test/resources/pulsar_client_key_wrong_host.jks
 create mode 100644 src/test/resources/pulsar_client_trust_wrong_host.jks
 create mode 100644 src/test/resources/pulsar_server_key_wrong_host.jks
 create mode 100644 src/test/resources/pulsar_server_trust_wrong_host.jks

diff --git a/src/test/java/io/github/protocol/pulsar/TlsClientTest.java b/src/test/java/io/github/protocol/pulsar/TlsClientTest.java
index fd38568..cdda0ef 100644
--- a/src/test/java/io/github/protocol/pulsar/TlsClientTest.java
+++ b/src/test/java/io/github/protocol/pulsar/TlsClientTest.java
@@ -101,6 +101,36 @@ public void testTlsCustomCiphers() throws PulsarAdminException {
         pulsarAdmin.brokers().healthcheck(TopicVersion.V1);
     }
 
+    @Test
+    public void testTlsByVerifyAndNoHostnameVerification() throws PulsarAdminException {
+        PulsarAdmin pulsarAdmin = PulsarAdmin.builder()
+                .port(server.getWebPort())
+                .useSsl(true)
+                .keyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath())
+                .keyStorePassword(CLIENT_CERT_PASSWORD)
+                .trustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath())
+                .trustStorePassword(CLIENT_CERT_PASSWORD)
+                .disableSslVerify(false)
+                .disableHostnameVerification(false)
+                .build();
+        pulsarAdmin.brokers().healthcheck(TopicVersion.V1);
+    }
+
+    @Test
+    public void testTlsByVerifyAndHostnameVerification() throws PulsarAdminException {
+        PulsarAdmin pulsarAdmin = PulsarAdmin.builder()
+                .port(server.getWebPort())
+                .useSsl(true)
+                .keyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath())
+                .keyStorePassword(CLIENT_CERT_PASSWORD)
+                .trustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath())
+                .trustStorePassword(CLIENT_CERT_PASSWORD)
+                .disableSslVerify(false)
+                .disableHostnameVerification(true)
+                .build();
+        pulsarAdmin.brokers().healthcheck(TopicVersion.V1);
+    }
+
     @AfterAll
     public static void teardown() throws Exception {
         server.close();
diff --git a/src/test/java/io/github/protocol/pulsar/TlsClientWrongHostTest.java b/src/test/java/io/github/protocol/pulsar/TlsClientWrongHostTest.java
new file mode 100644
index 0000000..780e0ab
--- /dev/null
+++ b/src/test/java/io/github/protocol/pulsar/TlsClientWrongHostTest.java
@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package io.github.protocol.pulsar;
+
+import io.github.embedded.pulsar.core.EmbeddedPulsarConfig;
+import io.github.embedded.pulsar.core.EmbeddedPulsarServer;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+
+import java.io.File;
+
+public class TlsClientWrongHostTest {
+
+    private static EmbeddedPulsarServer server;
+
+    private static final String CLIENT_KEYSTORE_FILE =
+            TlsClientTest.class.getClassLoader().getResource("pulsar_client_key_wrong_host.jks").getFile();
+    private static final String CLIENT_TRUSTSTORE_FILE =
+            TlsClientTest.class.getClassLoader().getResource("pulsar_client_trust_wrong_host.jks").getFile();
+
+    private static final String SERVER_KEYSTORE_FILE =
+            TlsClientTest.class.getClassLoader().getResource("pulsar_server_key_wrong_host.jks").getFile();
+    private static final String SERVER_TRUSTSTORE_FILE =
+            TlsClientTest.class.getClassLoader().getResource("pulsar_server_trust_wrong_host.jks").getFile();
+
+    private static final String CLIENT_CERT_PASSWORD = "pulsar_client_pwd";
+
+    private static final String SERVER_CERT_PASSWORD = "pulsar_server_pwd";
+
+    @BeforeAll
+    public static void setup() throws Exception {
+        EmbeddedPulsarConfig config = new EmbeddedPulsarConfig();
+        config.enableTls(true);
+        config.serverKeyStorePath(new File(SERVER_KEYSTORE_FILE).getAbsolutePath());
+        config.serverKeyStorePassword(SERVER_CERT_PASSWORD);
+        config.serverTrustStorePath(new File(SERVER_TRUSTSTORE_FILE).getAbsolutePath());
+        config.serverTrustStorePassword(SERVER_CERT_PASSWORD);
+        config.clientKeyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath());
+        config.clientKeyStorePassword(CLIENT_CERT_PASSWORD);
+        config.clientTrustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath());
+        config.clientTrustStorePassword(CLIENT_CERT_PASSWORD);
+        server = new EmbeddedPulsarServer(config);
+        server.start();
+    }
+
+    @AfterAll
+    public static void teardown() throws Exception {
+        server.close();
+    }
+}
diff --git a/src/test/resources/gen_jks_wrong_host.sh b/src/test/resources/gen_jks_wrong_host.sh
new file mode 100644
index 0000000..549ab3c
--- /dev/null
+++ b/src/test/resources/gen_jks_wrong_host.sh
@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+client_pass=pulsar_client_pwd
+server_pass=pulsar_server_pwd
+server_dname="C=CN,ST=GD,L=SZ,O=sh,OU=sh,CN=nonlocalhost"
+client_dname="C=CN,ST=GD,L=SZ,O=sh,OU=sh,CN=nonlocalhost"
+echo "generate client keystore"
+keytool -genkeypair -keypass $client_pass -storepass $client_pass -dname $client_dname -keyalg RSA -keysize 2048 -validity 3650 -keystore pulsar_client_key_wrong_host.jks
+echo "generate server keystore"
+keytool -genkeypair -keypass $server_pass -storepass $server_pass -dname $server_dname -keyalg RSA -keysize 2048 -validity 3650 -keystore pulsar_server_key_wrong_host.jks
+echo "export server certificate"
+keytool -exportcert -keystore pulsar_server_key_wrong_host.jks -file server.cer -storepass $server_pass
+echo "export client certificate"
+keytool -exportcert -keystore pulsar_client_key_wrong_host.jks -file client.cer -storepass $client_pass
+echo "add server cert to client trust keystore"
+keytool -importcert -keystore pulsar_client_trust_wrong_host.jks -file server.cer -storepass $client_pass -noprompt
+echo "add client cert to server trust keystore"
+keytool -importcert -keystore pulsar_server_trust_wrong_host.jks -file client.cer -storepass $server_pass -noprompt
+rm -f server.cer
+rm -f client.cer
diff --git a/src/test/resources/pulsar_client_key_wrong_host.jks b/src/test/resources/pulsar_client_key_wrong_host.jks
new file mode 100644
index 0000000000000000000000000000000000000000..cd19b61b1ad40e9202425682754e8b27923d6ba0
GIT binary patch
literal 2694
zcma);X*d*$8pmhG%xDH-EMrL|Mq_jgvW~SBjb(&uO$H&1trW7Pv1@D@gp5hDg>=fA
z?cik3nk;h~JJ}VIW!&y_@6&nir+YuV&-=W;|NDPG{+}01hLb@+HY^z~2ZhPT7{+|(
z0<r_?WVjfZ3>W^11+ZjD*?&opTre4u^%JN6tW+q+e_Wh!Ac#(e=>CM7Shrse2p85C
ztM>QEiN%2VgOiR6t3qK7L;X`MzVCJ|%ISUAK_D3(5Ksck2|e-eiy#;TfE9znh%tsh
zS2i$E7R>WfD=KjOC67c=3N=JAGIShF1`m{DaLJEi07KMwjqX+_od#O+JFbTW%J{ZR
znT8YFY${Ck?gdX|+fv3{D)i;%NB`l*Z!~v;(=S=x#}~z~=3j%oJ$A&rJOlM6*4l+H
z>9;F^nTWsKS|zOqYW-YL$WITDYdWc$7;4LbNvYbpv$VvH4a$dk$V@owdI1T~bhA)-
zF<*4jChbdE+Dylzv;GFm4fLDounGHXaa5zbGn7I@wp5^aQ+uq(nWKBV!WIkC5^%z-
zwp7yAz@ST8$CpPM9AP4k?st7D9pxnu&(HTO*E+!UsJ!Fs)h3dlLvqDK@}=oowx!SD
z5r3)g3L+6XhlBA*i&AI3!IGpY*d<Yi6f(k8WPi^1GgonFMicZ?uSh(vA1S_@=2F)!
zix&HkKN9k;;CX|LyHvVFc+Bie(SUWrX7Wo!XW4G`NSL}q64B&`L)}tT>}=`EAW<L$
zVn?v&vtJEpp6)|Lrvjl==})cNT~9wwisTxizZdd0z2xw*Xo;%jUbJW*VWrj=IWDxR
zIirWmzuF=5&16zG5*EtdFibiugIW)g<u+VeKEW`R=dNDwX<l9FGV*v4X-u*z7F>V&
z;V*o*lg=&N9uI`@8qd0-!g{#yBcXFQk@PvfbqY#7h$_7J^}{QO>Ou5U@vdagQ)gDg
z0<ubg#+QLR8R{cm_oeyZF?m0<c(};3o=9mrI0Ltd^5W*R^Mn_(H~Vp0L%$1_B}v?g
z&)aR}(VP3&>#R9I;^+EI_&vPUmVVc0l!MD~_GUF5&uuD~bSRh*H+c06D~*Qw-8x>L
z7Qe4ZlAq{Cuv2qOr8d%UrFSkpJ8K-+pofu?jbiei?Ps5K4IN(*Un_I>!M9GF_b?g%
zi&ydtf|Ge`Xpvdb`&&uZJ&(3S%T$}`*B2k%P@8#Z)-_JsUEZB2?g<w6w|Vk$ZzU@t
zCjk=S72&8Lhw<QhvISe<LY4^m4eUT~ex<z)wOb0LA@}mM9WKASAbdv*P#yKK$4Apo
z$2MpDK;@a6;Ph{@y5_wx9ARq^D-Bz|UZdFroTW{oft=mBaO-TP;YE}gx8t?j#R9QK
ze7dWTa_B2<aM7)D8piUj1PvV9v7it6Sg2tkR?<zH@J*RkS8>$`lO->{VcU)jbKLK<
zLHE|9?<VZ%GKYeNqp@Qm)ZI#l`;5m!KJ5=)w73&%tn|#;F5qkjoR5a37_o3#M{GVY
zqgdLVTTxvsxpLi;bv`tu^8Cp)jBlT<-wCr?o%ePJIDi=cWxP;JW2V63#PuD@=w1-2
ziRal{(+sN!f1)F!Q`LZS^t6^e1G_t{o>L?HUTr=p(>rg-B}b%5rJeW1V1lp8c^a+8
zrC~o`@c|CR;1+buA8^6^!B5Ie#ErPvQ&r3QQ7D@*0P~zD(K+{;Ol-2&LG`Ng;Dq(J
z`k9e&!@w?lXlbJ9%E=4sZzz7IzE4BMyF=>s0ne@&07u_>h^l5m?C4Eu@OB|%`0{c<
z&wYhGQ!S6=<X(Y8!kCXfz46tzM_tOwa;KlBY@FcbKIIg&*wycRwtm|$;KHO;HXD_j
zF_11?E4Um+DkpS5UTD6!=Ex`+ewNv!5}=iI2caD}T=Tt6_J$3^+LNB&hgW|bE#sLP
z5vIRcXNUFpfmG1O3jc~r7{3DNX*j?e5Df4FxB`N)Xa1H16!^giOAl{X2?Z5Zbwza*
zH6;Zl6=f_L?DT7i9ZDyI&3__O5D@UQ8T_pP|5r#CFf;1B%z*B|2azEDyK>?=ed~Yz
zKOz0`b{U9P8%VDzh;wOvE2<wsW*b<XUuwDX_4<e%rRtR{=hw+l!7DXxlKn|$j=^H2
zP%pej+K-+&!i&%ErQ&>XIi{Z~dFi@}VjA7(T?p}JBCgti6$dDV+k}~`RkX!=)zGO)
zgF*HMj3Q&(Zf}VcLE(&&X5TSu3u-o{LU%4PBy-zvd1T=9AdxjaxKormSlAP}j;XgE
z>wf*3j?ra0BbBaBnc~1+D82U<ge~7V(eNxBbZlSTU`s-~=T^ZRD;OH+B`%+7%izmS
zm771yz{6!!5CjLl8p5^Ji2OKgOb~oHa&uEs)AviH&h!jZnlXh?x)?Yv^u|SUHbYK2
zTC}iQt5Woong5j^A$utOR#0`nH{+ZNm|SSCU8Y=L%zk15fmGFEtBdWkCx)XV2hvs=
zoJRA$OxBqk!J0em#4e|tS@Vn#+?KtkT;IN+u?Z^3xN6?Sb@TeDR=YUAlg!ekU8n6}
zoK8$|<FN51`K7?3^&pFtAvP^Tek+lp7!HORM$!)J*vqeeES}X8=l*B;0Oeca=JL+B
zBB3WM^;4E3=(s$^b5yd_w9)lBRjB@AThT^TpR5>ilL8I9GERytmO4^w`4HZT%9?0U
zmn63|zgMR)WOi({><tReN<MWE8nu_ye15dN3NSUy`j+;is*T8gnU#CRvj2p+X8X6x
zZ4qYbI{{O<>mQ7K52V?8THW<6|MVDLNuMl6f4<<CyT(i6NsxW*$}%inLJn9pE4E(^
z9~;fSTy1@vfH#?SbBgv0tislAS)V?zA9N>y_b)kGbDWLZ+76Us`JoSiYw~T+JJ5vT
z={{st<mR#3X^rpbTt<Dt2!}$II=>v+NT?m^8pgIF?TDApp2qJJ8Z@1F%Hb~E(a7lo
zpS1H2h&7sBkCYnoU?!^9YGu5vjy>Cb$d2Lr%Rnin!&XetiH(S;U9qskH_;kp!muXk
zAM4(;h-&@Oq#Ab8eVmMI&!@+wYgf1Oc@kjB3SVJ05zKH8ufgz_DBF`+<}hKvGrpBF
z0m4|6yObX-@o;bO*b7CLxKm>9rmBZmQND>^$voqm_Da45BBXN_;m;#K<H7mR!9>A(
z<s|+Rmr2<JAb#qP5GRm~|B&7!Ie1!sN3=#rCM=;;S<q|Mn1Q}QQM`Bm)w!g1Fm>t?
z6#BMZ$rFXy4ocmN?d%UwQcS>}X44aSJa<G>Kb}9LpF%_fZEmHA(|$X>#Dd(c(8W+k
z5&p-3SVB3;>r~Q#+w<;XTMeS#XnIA#5=HyDs|e-EyhoSZWKiStYET}J@cXawHQV90
zE0O(vT0pD`RsqZP>o)@dApo#MqZa*+U=)@TF@DXf`=Mt!XIOG8kL$8ACM5Y4%b6nz
d%nxij&n1s52D4*3({AiTSxepA7ycC~{{)c-&%yuz

literal 0
HcmV?d00001

diff --git a/src/test/resources/pulsar_client_trust_wrong_host.jks b/src/test/resources/pulsar_client_trust_wrong_host.jks
new file mode 100644
index 0000000000000000000000000000000000000000..67fc79e515e303c860fd398e21b129ecc92d61e2
GIT binary patch
literal 1222
zcmV;%1UdUKf&{_>0Ru3C1Z)NgDuzgg_YDCD0ic2eT?B#zSulbGRWO1CQ3eSrhDe6@
z4FLxRpn?QKFoFa=0s#Opf&@1P2`Yw2hW8Bt2LUi<1_>&LNQU<f0R;^(Sui*T2`Yw2
zhW8Bt1q?7N1Qh=zvek2V=@cRO0m9lL3jOD2!S@0JClCSwATSID2r7n1hW8Bu2?YQ!
z9R>+thDZTr0|Wso1Q51E+?ADJzTcCzc}&8@6?uSy1HkBUjDV#)aehV>zwV<NL}T^f
z!{9sT*poizuDbVrzPD?MRU+VX^F&%`Mf1yAu9T$g&wT@3q}N%lbZerNOX63RmSV0+
zadD%Dk0tv(5kwIVXK`4()qkJqoq6N2ojV5EqpOu>MZkQhbIU9LmM1{{B9%XYbT5gs
zsKdg-RwuiJzokI5-Yvxgx@Sb6C}gBV`^e<HXug@0UsGqH*<N91ZA1ZtFf0O(xK6Pm
zqv0CRCR}7oS)aroeSFpX#NTgEj6s$i{t6csq>Uw3#EG1dl4irPzw4Y9mmmD`^dwK?
z*cneDB1mfOTo!B<z*cD-MX2k(+Ec2U=<UDR9n}kpsw#a)<@UM!OWOj;U=L7~U=HXb
zz{KJn#hD^s#ZRMxp(Y|f`)?bWAWTL7xiX>qZTtfSf)DoGCf(MJI_|XqJZx!{!MIut
zv9jOic?#~Fjkl&YFugwxAs9(Np9cLi0<2W`9@siR({qLrBK~Vphve8yz``V$2}p8U
z6qWLNJ;MStr-{u7@ZdR>Q>h<U`@ro4AH<7@JX+kjII%ykvCchpT8Y)#->j$lgf}jT
z&9RR7D*3HD^_Nq29hy%gn%fOFWQwR1aSg8COBIeCx8j=I@W|f>+4k$MYb5(u#@}@c
zq%Amz;m9`jJfhQ>ghjB_nsTavuH=4&LawFnM#gT#Vqb!L3Wg8Ax@CyS*Oy&=>S_pI
zKN&;rATQdp>8j|@Tc`RFO2F-c6}3o<+U^n*&hPx)0qH4_vJR-TCni}NzhBkpG+kin
zKV`J{&8C5<eO^>%7TDL*rI~QrKv()lZhKlu!R&p;{G+g(t+?s0^?%(3L`dzC=}fpX
z4dQCoe#x&?!5`j<1zC_j6yRPkSN+6a#XzbAHzZ2YgCD+|S|O#|UAoE<D|Ct7&${ds
z7+SA2#V>{>a+SXV09+!}&XAZ-gZ=yQ2dxlgcz1r`Un>7_wjIvx*emVlS*63GYCh%Y
z>&fh5{`!E>1|!pU)wZR9m=z#k{m4T#RlX9Oez$|}=!J@_OMKGd*k-{O#bVWP$FE6J
zk>Zp8G{>pR9WSGPtX@I}KRz<ORyycvR;uZmkT1K%A~c7lU%BfkRzD_eYWN389P;d5
zcbF|ELtHMgNnz5TjOm{{a_T9eWWXS)t3QF8F?<QP)+@7#Z0eF#qKIj4VQ)-gQG;tR
z+Uh+@DZF0nN$`Kd=4!AW1p}g?3xDKmfs}w!9P&)W=5_PGGr1a5>4obXcg3duI(A$c
zlOHko=yWhmFflL<1_@w>NC9O71OfpC00bavf3h8khktHBDwD>dsb$Y}663nH&_$^0
kU74L9rgvuq6d>7aBX&bov|bdgD0X%kD<M@-Kmr0M5G;B@ivR!s

literal 0
HcmV?d00001

diff --git a/src/test/resources/pulsar_server_key_wrong_host.jks b/src/test/resources/pulsar_server_key_wrong_host.jks
new file mode 100644
index 0000000000000000000000000000000000000000..d4bae0a0b7276bd92841be39f53053fab057c38f
GIT binary patch
literal 2694
zcma);X*d)N_r_<&3>hY#iDZefXCEepNs;VN)+`ZO!h~p3#x^k+OpSHyMB+h~>{+rU
zLu84{&SM=0nZ!tj-u~DBy?U<q)BAon*SXH`KKJ=}Uk6Em5<oyUBmt_(&M8kcChoz2
z9Kd`6^fZ_N75s(ykpxKje@KvAFaeVJ3#b07BzCTUySSl1P(A^o`wMC#y?#3&Fr))g
z^PiC$sQ~6HP~O?$S*i4UeC>gVO@v*a=$U(mAdoCC2#7#(vmg8aiy%%20C}37)0Jop
z^kf4A<-xptnG+^2htBkehwdujtt;8V1n@A$3ojYFLfZ)lO3$o}yhQ32&Ac!!if-Q1
zeJ?tvUw0aDK!$fFbh7)2c|EvuHSq8mu<C8<#fKh&MUH=SGH9<P$8}ELZ(LOz6g>D-
z$kqa*p(oP&SJOFs_>qB>bk^Ux;+byy4Ua~z2K?DwAzXE1@ae5RvTFyWLn8!1%G&c|
zMl&b*Ue`6pjjy4pyKvb4NhB7$SZzGnm&m`F=h}GpT`2_FK8IJXv{qd13E$psb@_uR
zLv4s~FQIVJTQ%-;-q2jAE|V3n6~8>Kv>U;?SbZp}&he6?>`s%Q5Q~z+TTI>W!a25I
zzd}@hv||*O9X7iE<(LyRi6v;ZT1NcAhZ;OPCD)>z3_ix?i*{_W$z98AZIVcPJ21`}
zs+a`fKh==}v*1xm{D4_!mfx30solLls6O#}Xx!sMl-0OO8Yj2(w}zu7uOzdW65ZY?
zPP;Zs?<emp6W3F(v$2j0<8~``4G-zCJIdz)q?mO~zE|j<B(q&~`-(JeREQgNB>{#w
zP23wkCxN0Z;{xPbCbk1=1eEbNHV|G{ii{y9uEMd@>u=b(+g}QYYH=kr=jQ}RW!Rp&
z-7mTjERYHCX>Q3mp|CMlD=Ki$<AU4a{*)C}qH5lb7N&T>zB0OtA3r<2R}}wXdUyl|
zH!G-V_xaWujGV85bBljv&U@CRskFH#V88o+(-^P5Rg-(<;WRYSeR7FoYB0D->t`Lr
z3M@bS^ojipzn)_uxw#7eF@xtbu;zzTx_Fav)<y%yqn18b77Do29tquZ3rXVXduuY+
zxQ2cRPq@yM2uU0p`rE@ffYGzztidQerDS#M-g4=!NaLD-#%CZ(u&XCJ4Is%UIy>^-
z(%SKUMr21#Q+a*KIukRb&f)7V4pWMTNVcgw`f2uxa%dGICUZ!m8KI+M1YMY92kTuu
z^#cB3G3R4z5*|D`98Z?6%ATRk@n^ZXNoJUi8sg?8<bzHQB!Fx^3PADMY%y$em!{*V
zQ0aM_5kE#ddef4N;bNEIlE)8Cv7aKFi>E5)S|2bvWs}d&Pb{`}o^et&bQP4$=DyN(
z<{8&#DIUPu?FhCgJ9aED=HkK*92Q=jl24OSOG{G(lQywTmzVzX&(<W`{7@f*`+gQ0
zd2=GJ@v7I`o~urAcdNissJ=YUOIlZTzDZ@FR%bdE`}J^3@i`B29mZFtK1(B#$rUF&
z`O?~^A7M6{kE^M8<G{-cq0#6TZMpp$-bc&E#B}?Tnu-@Fn9;d@{UkTOGKJDAR9;t-
zOQH3^&C=K0HK~zxa~ul#hGSvxbad(C&fZJFDk>v|7!e|_GSd80(rj*({D$Ol;J<_#
zSt6c=^a;GdC0;Gh`fCg2T>V2YNy#{AxpmOu!)0sGQ(@R`Q`e^NX-~B~6N07ez4AM+
zzrTvHv3g?rbNk@9i%we4NIKnz+P%<%(?8Wox=(^VNUvv3jhzcYxao=n)H3_=+S;h?
z64~TS!)@b|KITC&r40#kmWk8Ne-x+CE@4Iy@cw~^RJ9lkeXEz(({2Ip<wmcoZWObx
zbw&6Lj7@HTJkg;r0`K3VQe#idPIbsl@LkSNwcgN~*m!?l`pCep_gQMVs8#KS6?!l`
zhen*)5#v*B)BU%q7m$L#<C2q4m0J`F@B;(^d;y+-Af)&|62B@R7;fY3=ZR3&Kx?UK
zX=tL<kgA$U0@&^M5(j%e0c`yXnS+3UU(M(r1^C}Wdf#EoprkS0PjzEO0zYCoJS+y5
z|6f9yIsh^Iw8Q-vsm0;A=_E=CC$J44Cl<sO_&n6F@cf~EOEWLy{Lb;NOxS=dW+aF}
zW4&<70XX)Qezm&pZa-%CIOikj%0|V^z1p7f?Jo)*=lN!g)wpd@GqTmu6euV%lL4;q
z`&6pb0?EVjy&g5Q<dM!oCZB{P(tmudThO|y+1CR&T`|Bve^wyBF5qV4TTd}AF$4>}
z)x((ds@-9*2wFEL7AX-TBTq95O|p6{Y6EZj1I8-9yh|SgN9#73Z_!nB4)Gp=M{VM0
z(?Cc2hWOzh^?d}9pP}BZspj-vF5|Q>IPZ&h>?BX}>PE)_r2CTVQ+<m{Fn<6)^IqDt
zMFp>fCNb&!qp`O_)v2jdZ>ZFnlJ&7bz{^gh_G@m>&ke;?#XegH?xw@NqAH|!x{cZu
z*)5RHb?M2%Vb)8?7hjxn8S(i?BpD&)!{s%Q2Dwuxaa#qvK7@O-5{@p7jZ%HBg?@CN
z9%!CwkJDU&q8c_S;tt=lwOB(+a1oK52TdQ{PbAzlsc>esyX~33V$Imlq*#M+f>i3|
zcaKVivsKbUY74sWAuKgMtd)z=q)nqTlM3IHChARi13W3g-sOgs#P<g&F;72Js#zY2
zGF0XeU5Hl%P3y(Tt9|LoWzz6aAACC|n8P8lkZ^HzWyW7f2U{3-D0i`tqUlhKZ8bY>
z8Q?jazPvFM?GHIjN_J7eQjQg2MMws?ZdHlzx!;EQ$?}cHlGM{_G5W9JGWF1v%rekj
zbc4H)uOtX`;U&1FZ#|GNZo~Mz-=f0q`EBk^`|vDA8R-=?p*%8!akWT|Lqpj1#E@1>
zSwFcr`QTy4T+bFH=%Si-?pLz&?BmHQyMEbl6)$>V!4(91JxSX_)6fm(0dWcMj@1&;
z$D7LU4!Xb4cS-ERHq>kaykd!WO+0<LxfB=W&k*z=lh>XTcEUEy$Sqcf(KfRVFWVe*
zIzlZJS9eaaGzRdm@aE-m=lBDr2<b-ri;O3eqY{0MYYNq=E_2q|xH0{Tpa7g__1A&!
zS)0b}>D|=~Dl@o}I$!;`Yut3x{dTpcfugP1EKD86G;W{|g*gZ1c0?TLPo;exQZil0
zbN*2Gv~*!9|Dk|0%vWnQ%HSSM1%2xI%+$ydU|m9|?KYc8{a<SbVSTLJfw;xm*H0|I
zObR}d@+$f&;4iV_l&qXSca!{L+_N-WCg3s&*N0`3kz05eeLN)C>EN>Yo85Y5hf;A5
zzu~+bBlv}P9=leT#1T}WrC1dKOTti3#tOUZ9b^v9$8u7i_Z?;$NEfBEDw#q%wR=SJ
z#FjK5LM{wxhEzque*b15AOrwLFjo{Uw{Eu-Di~kin3~U-(i9_GQq~zZ<u+1H%ll_5
d!F)A#pKj}C0P1go^P01X*idE}QttmE<zLN<^S%H8

literal 0
HcmV?d00001

diff --git a/src/test/resources/pulsar_server_trust_wrong_host.jks b/src/test/resources/pulsar_server_trust_wrong_host.jks
new file mode 100644
index 0000000000000000000000000000000000000000..668dbd629dbf6f87f853123598e30c6a965b2f74
GIT binary patch
literal 1222
zcmV;%1UdUKf&{_>0Ru3C1Z)NgDuzgg_YDCD0ic2eT?B#zSulbGRWO1CQ3eSrhDe6@
z4FLxRpn?QKFoFa=0s#Opf&@1P2`Yw2hW8Bt2LUi<1_>&LNQU<f0R;^(Sui*T2`Yw2
zhW8Bt1q?7N1QfIkob*4#*(qw$XNUzk>gD+Br}qK^ClCSwATSID2r7n1hW8Bu2?YQ!
z9R>+thDZTr0|Wso1Q5FpEPChhDoNjCG(Q@u%P4??1Hb^PhAVZ@V0F$uWQ4g5Qvx4`
z<&cKJ{ULzOHM`E!m%|_SXyA)PDC1PqoxT6NqIXlReM6|HbOi6O)R4CRp0|1(lW)mo
zvt|<awL|Vx*a)8pD&e>nOr*lJ2)r4l8hsNdYT0+oyd@`aB<Fv|FP9P{fivGw_;DEV
z2|rYaflFWKJIzy&dX0ZC!iu{xs!Qk|Wek;0m`8?CV*`}(%&1wAVy1EPKo<ly|0bW$
z%`8@R8yKRK3qS+6Kh6nJTvK&+ST#Hh+L}))T{bLq_FWhkE;dn=UzUS<I*Es<<?dW0
zMiGhxoIV@vX}GVp(=~pau#rxD#epD*XYci)Sx7ekxtA>P`w??tzP~;h6;5`$*ZEMR
zkU}1mo6#sDCusE2!pZG#6|A7yyf69-9<d>5b#uEf#^J)7MNp!+JwSMk7vSh`#BBxo
zN#{`EuPzy_$iUjMEp>(&*N6A&yfxHYqUKtM>Y~`i;ZT_W_D@(dl2-Jbjp<W+w$df8
zC|+YRm@cDSR`FPGUF($T_ssq;fScAK7A=6tA5?XDz%)`O<HYqxVPPOXsV5*Bjk`68
z_LM#aqob=FJe<+R0C|yZQ77itwGO_wkQ@L1pm|Z$2j4W~#<cl&vHZBG6lr?p2Yy|F
z{s&)4%`%HSs93nfm*3Y2ybceMq;2|M<Go*wJ;JipIHmnt&_&c2M{^7qTxC~(u2Lsg
zWqoymC+uCrVi0?IN8>uTPdk|90(LRH%9R%*G|<OQBV{1~251L$_3p@7P`up!#xz$R
z_iB*XE-bgQNtD84WysA;<--Vw4h<j8p^I+AP^JuWUwRdCqa^Y-oW;>>d%c9!+GQyX
z-CZ(E86eGy^;{NftcBfzTYF_UB=RZ1s&mA;&!yFQ6Vz>qe?K~4okSRvIIF9#@nqhv
z@x5<5i)rDbKad->qBd3hZ26eLpzi(5ap)X_Qrz{jf?mf`jPrbX=Y2fK5d`V!>pSr0
zki5nBt!d`cKm1sk;8A<TOcNhC_X*btv*K?IlL1UKcZwm3f5)Vf$nfJJ6PFwBbHS5G
zjrqxy8<@!SyDJP8w!d8DLQPi%V<8NHtp<Xt{up%vHvE~gLdLraItfeKFAyU_&TIhD
zw`;ZWbdq&rstQBRX9SeFK7|61et7ZFVDa0y--{`?Qsfk^b%7wV@!_;Mytw<bejQpt
zTj>3%(>>Kg4&bYt^S%8VH9~EKIYVcJJRLYV!rxprOw|v;vg+cO^0Tu5h?3q5Uh<Ql
zn;#eFbnP%rFflL<1_@w>NC9O71OfpC00bb}2v5APy~=7RcXa(*QcC`>bUXU`qC2sf
ke}o~dIP2{M6l|C=qWR5U9ZjVZ?hHP!x*H?{o&o|V5CGUT!2kdN

literal 0
HcmV?d00001