add no-localhost cert

src/test/java/io/github/protocol/pulsar/TlsClientTest.java

@@ -101,6 +101,36 @@ public void testTlsCustomCiphers() throws PulsarAdminException {
         pulsarAdmin.brokers().healthcheck(TopicVersion.V1);
     }
 
+    @Test
+    public void testTlsByVerifyAndNoHostnameVerification() throws PulsarAdminException {
+        PulsarAdmin pulsarAdmin = PulsarAdmin.builder()
+                .port(server.getWebPort())
+                .useSsl(true)
+                .keyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath())
+                .keyStorePassword(CLIENT_CERT_PASSWORD)
+                .trustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath())
+                .trustStorePassword(CLIENT_CERT_PASSWORD)
+                .disableSslVerify(false)
+                .disableHostnameVerification(false)
+                .build();
+        pulsarAdmin.brokers().healthcheck(TopicVersion.V1);
+    }
+
+    @Test
+    public void testTlsByVerifyAndHostnameVerification() throws PulsarAdminException {
+        PulsarAdmin pulsarAdmin = PulsarAdmin.builder()
+                .port(server.getWebPort())
+                .useSsl(true)
+                .keyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath())
+                .keyStorePassword(CLIENT_CERT_PASSWORD)
+                .trustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath())
+                .trustStorePassword(CLIENT_CERT_PASSWORD)
+                .disableSslVerify(false)
+                .disableHostnameVerification(true)
+                .build();
+        pulsarAdmin.brokers().healthcheck(TopicVersion.V1);
+    }
+
     @AfterAll
     public static void teardown() throws Exception {
         server.close();

src/test/java/io/github/protocol/pulsar/TlsClientWrongHostTest.java

@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package io.github.protocol.pulsar;
+
+import io.github.embedded.pulsar.core.EmbeddedPulsarConfig;
+import io.github.embedded.pulsar.core.EmbeddedPulsarServer;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+
+import java.io.File;
+
+public class TlsClientWrongHostTest {
+
+    private static EmbeddedPulsarServer server;
+
+    private static final String CLIENT_KEYSTORE_FILE =
+            TlsClientTest.class.getClassLoader().getResource("pulsar_client_key_wrong_host.jks").getFile();
+    private static final String CLIENT_TRUSTSTORE_FILE =
+            TlsClientTest.class.getClassLoader().getResource("pulsar_client_trust_wrong_host.jks").getFile();
+
+    private static final String SERVER_KEYSTORE_FILE =
+            TlsClientTest.class.getClassLoader().getResource("pulsar_server_key_wrong_host.jks").getFile();
+    private static final String SERVER_TRUSTSTORE_FILE =
+            TlsClientTest.class.getClassLoader().getResource("pulsar_server_trust_wrong_host.jks").getFile();
+
+    private static final String CLIENT_CERT_PASSWORD = "pulsar_client_pwd";
+
+    private static final String SERVER_CERT_PASSWORD = "pulsar_server_pwd";
+
+    @BeforeAll
+    public static void setup() throws Exception {
+        EmbeddedPulsarConfig config = new EmbeddedPulsarConfig();
+        config.enableTls(true);
+        config.serverKeyStorePath(new File(SERVER_KEYSTORE_FILE).getAbsolutePath());
+        config.serverKeyStorePassword(SERVER_CERT_PASSWORD);
+        config.serverTrustStorePath(new File(SERVER_TRUSTSTORE_FILE).getAbsolutePath());
+        config.serverTrustStorePassword(SERVER_CERT_PASSWORD);
+        config.clientKeyStorePath(new File(CLIENT_KEYSTORE_FILE).getAbsolutePath());
+        config.clientKeyStorePassword(CLIENT_CERT_PASSWORD);
+        config.clientTrustStorePath(new File(CLIENT_TRUSTSTORE_FILE).getAbsolutePath());
+        config.clientTrustStorePassword(CLIENT_CERT_PASSWORD);
+        server = new EmbeddedPulsarServer(config);
+        server.start();
+    }
+
+    @AfterAll
+    public static void teardown() throws Exception {
+        server.close();
+    }
+}

src/test/resources/gen_jks_wrong_host.sh

@@ -0,0 +1,38 @@
+#!/bin/bash
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+client_pass=pulsar_client_pwd
+server_pass=pulsar_server_pwd
+server_dname="C=CN,ST=GD,L=SZ,O=sh,OU=sh,CN=nonlocalhost"
+client_dname="C=CN,ST=GD,L=SZ,O=sh,OU=sh,CN=nonlocalhost"
+echo "generate client keystore"
+keytool -genkeypair -keypass $client_pass -storepass $client_pass -dname $client_dname -keyalg RSA -keysize 2048 -validity 3650 -keystore pulsar_client_key_wrong_host.jks
+echo "generate server keystore"
+keytool -genkeypair -keypass $server_pass -storepass $server_pass -dname $server_dname -keyalg RSA -keysize 2048 -validity 3650 -keystore pulsar_server_key_wrong_host.jks
+echo "export server certificate"
+keytool -exportcert -keystore pulsar_server_key_wrong_host.jks -file server.cer -storepass $server_pass
+echo "export client certificate"
+keytool -exportcert -keystore pulsar_client_key_wrong_host.jks -file client.cer -storepass $client_pass
+echo "add server cert to client trust keystore"
+keytool -importcert -keystore pulsar_client_trust_wrong_host.jks -file server.cer -storepass $client_pass -noprompt
+echo "add client cert to server trust keystore"
+keytool -importcert -keystore pulsar_server_trust_wrong_host.jks -file client.cer -storepass $server_pass -noprompt
+rm -f server.cer
+rm -f client.cer