OpenSearch Data Prepper plugins trusts all SSL certificates by default

@@ -47,6 +47,7 @@ dependencies {
     testImplementation 'net.bytebuddy:byte-buddy-agent:1.17.6'
     testImplementation testLibs.slf4j.simple
     testImplementation project(path: ':data-prepper-test:test-common')
+    testImplementation 'org.wiremock:wiremock:3.10.0'
 }
 
 sourceSets {

@@ -32,6 +32,7 @@ public void testOpenSearchConnection() throws IOException {
             builder.withUsername(user);
             builder.withPassword(password);
         }
+        builder.withInsecure(true);
         final AwsCredentialsSupplier awsCredentialsSupplier = mock(AwsCredentialsSupplier.class);
         final RestHighLevelClient client = builder.build().createClient(awsCredentialsSupplier);
 

@@ -1691,6 +1691,7 @@ private Map<String, Object> initializeConfigurationMetadata(final String indexTy
         metadata.put(IndexConfiguration.INDEX_ALIAS, indexAlias);
         metadata.put(IndexConfiguration.TEMPLATE_FILE, templateFilePath);
         metadata.put(IndexConfiguration.FLUSH_TIMEOUT, -1);
+        metadata.put("insecure", true);
         final String user = System.getProperty("tests.opensearch.user");
         final String password = System.getProperty("tests.opensearch.password");
         if (user != null) {

@@ -384,8 +384,18 @@ private void checkProxyPort(final int port) {
   }
 
   private void attachSSLContext(final HttpAsyncClientBuilder httpClientBuilder) {
-    final SSLContext sslContext = certPath != null ? getCAStrategy(certPath) : getTrustAllStrategy();
-    httpClientBuilder.setSSLContext(sslContext);
+    final SSLContext sslContext;
+    if(certPath != null) {
+      sslContext = getCAStrategy(certPath);
+    } else if(this.insecure) {
+      sslContext = getTrustAllStrategy();
+    } else {
+      sslContext = null;
+    }
+    if(sslContext != null) {
+      httpClientBuilder.setSSLContext(sslContext);
+    }
+
     if (this.insecure) {
       httpClientBuilder.setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE);
     }
@@ -439,7 +449,7 @@ private OpenSearchTransport createOpenSearchTransport(final RestHighLevelClient
         transportOptions.setRequestCompressionSize(Integer.MAX_VALUE);
       }
 
-      return new AwsSdk2Transport(createSdkHttpClient(), HttpHost.create(hosts.get(0)).getHostName(),
+      return new AwsSdk2Transport(createSdkHttpClient(), HttpHost.create(hosts.get(0)).toHostString(),
               serviceName, Region.of(awsRegion), transportOptions.build());
     } else {
       return new RestClientTransport(
@@ -461,11 +471,13 @@ private SdkHttpClient createSdkHttpClient() {
   }
 
   private void attachSSLContext(final ApacheHttpClient.Builder apacheHttpClientBuilder) {
-    TrustManager[] trustManagers = createTrustManagers(certPath);
-    apacheHttpClientBuilder.tlsTrustManagersProvider(() -> trustManagers);
+    TrustManager[] trustManagers = createTrustManagers(certPath, insecure);
+    if(trustManagers.length > 0) {
+      apacheHttpClientBuilder.tlsTrustManagersProvider(() -> trustManagers);
+    }
   }
 
-  private static TrustManager[] createTrustManagers(final Path certPath) {
+  private static TrustManager[] createTrustManagers(final Path certPath, final boolean insecure) {
     if (certPath != null) {
       LOG.info("Using the cert provided in the config.");
       try (InputStream certificateInputStream = Files.newInputStream(certPath)) {
@@ -481,8 +493,11 @@ private static TrustManager[] createTrustManagers(final Path certPath) {
       } catch (Exception ex) {
         throw new RuntimeException(ex.getMessage(), ex);
       }
-    } else {
+    } else if(insecure) {
+      LOG.info("Using the trust all strategy");
       return new TrustManager[] { new X509TrustAllManager() };
+    } else {
+      return new TrustManager[0];
     }
   }
 

@@ -271,7 +271,9 @@ private void setConnectAndSocketTimeout(final org.elasticsearch.client.RestClien
 
     private void attachSSLContext(final NettyNioAsyncHttpClient.Builder asyncClientBuilder, final OpenSearchSourceConfiguration openSearchSourceConfiguration) {
         TrustManager[] trustManagers = createTrustManagers(openSearchSourceConfiguration.getConnectionConfiguration());
-        asyncClientBuilder.tlsTrustManagersProvider(() -> trustManagers);
+        if (trustManagers.length > 0) {
+            asyncClientBuilder.tlsTrustManagersProvider(() -> trustManagers);
+        }
     }
 
     private void attachSSLContext(final HttpAsyncClientBuilder httpClientBuilder, final OpenSearchSourceConfiguration openSearchSourceConfiguration) {
@@ -287,31 +289,37 @@ private void attachSSLContext(final HttpAsyncClientBuilder httpClientBuilder, fi
 
     private TrustManager[] createTrustManagers(final ConnectionConfiguration connectionConfiguration) {
         final Path certPath = connectionConfiguration.getCertPath();
-        if (Objects.nonNull(certPath)) {
+        final String certificate = connectionConfiguration.getCertificate();
+        if (certPath != null) {
             return TrustStoreProvider.createTrustManager(certPath);
-        } else if (Objects.nonNull(connectionConfiguration.getCertificate())) {
-            if (PemObjectValidator.isPemObject(connectionConfiguration.getCertificate())) {
-                return TrustStoreProvider.createTrustManager(connectionConfiguration.getCertificate());
+        } else if (certificate != null) {
+            if (PemObjectValidator.isPemObject(certificate)) {
+                return TrustStoreProvider.createTrustManager(certificate);
             } else {
-                return TrustStoreProvider.createTrustManager(Path.of(connectionConfiguration.getCertificate()));
-            }
-        } else {
+                return TrustStoreProvider.createTrustManager(Path.of(certificate));}
+        } else if (connectionConfiguration.isInsecure()) {
             return TrustStoreProvider.createTrustAllManager();
+
+        } else {
+            return new TrustManager[0];
         }
     }
 
     private SSLContext getCAStrategy(final ConnectionConfiguration connectionConfiguration) {
         final Path certPath = connectionConfiguration.getCertPath();
-        if (Objects.nonNull(certPath)) {
+        final String certificate = connectionConfiguration.getCertificate();
+        if (certPath != null) {
             return TrustStoreProvider.createSSLContext(certPath);
-        } else if (Objects.nonNull(connectionConfiguration.getCertificate())) {
-            if (PemObjectValidator.isPemObject(connectionConfiguration.getCertificate())) {
-                return TrustStoreProvider.createSSLContext(connectionConfiguration.getCertificate());
+        } else if (certificate != null) {
+            if (PemObjectValidator.isPemObject(certificate)) {
+                return TrustStoreProvider.createSSLContext(certificate);
             } else {
                 return TrustStoreProvider.createSSLContext(Path.of(connectionConfiguration.getCertificate()));
             }
+        } else if (connectionConfiguration.isInsecure()) {
+                return TrustStoreProvider.createSSLContextWithTrustAllStrategy();
         } else {
-            return TrustStoreProvider.createSSLContextWithTrustAllStrategy();
+            return null;
         }
     }
 }

@@ -0,0 +1,186 @@
+/*
+ * Copyright OpenSearch Contributors
+ * SPDX-License-Identifier: Apache-2.0
+ */
+
+package org.opensearch.dataprepper.plugins.sink.opensearch;
+
+import com.github.tomakehurst.wiremock.WireMockServer;
+import org.junit.jupiter.api.AfterAll;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Nested;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+import org.opensearch.client.RequestOptions;
+import org.opensearch.client.RestHighLevelClient;
+import org.opensearch.client.core.MainResponse;
+import org.opensearch.client.opensearch.OpenSearchClient;
+import org.opensearch.client.opensearch.core.InfoResponse;
+import org.opensearch.dataprepper.aws.api.AwsCredentialsSupplier;
+import software.amazon.awssdk.auth.credentials.AnonymousCredentialsProvider;
+
+import javax.net.ssl.SSLHandshakeException;
+import java.io.IOException;
+import java.util.Collections;
+import java.util.Map;
+import java.util.UUID;
+
+import static com.github.tomakehurst.wiremock.client.WireMock.get;
+import static com.github.tomakehurst.wiremock.client.WireMock.jsonResponse;
+import static com.github.tomakehurst.wiremock.core.WireMockConfiguration.options;
+import static org.hamcrest.CoreMatchers.equalTo;
+import static org.hamcrest.CoreMatchers.notNullValue;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.when;
+
+@ExtendWith(MockitoExtension.class)
+class ConnectionConfiguration_ServerTest {
+    private static WireMockServer wireMockServer;
+
+    @Mock
+    private AwsCredentialsSupplier awsCredentialsSupplier;
+
+    private String host;
+
+    private String clusterUuid;
+
+    @BeforeAll
+    static void setUpAll() {
+        wireMockServer = new WireMockServer(options()
+                .httpDisabled(true)
+                .dynamicHttpsPort()
+                .keystorePath("src/test/resources/test_keystore.jks")
+                .keystorePassword("password")
+                .keyManagerPassword("password")
+        );
+
+        wireMockServer.start();
+    }
+
+    @AfterAll
+    static void tearDownAll() {
+        wireMockServer.stop();
+    }
+
+    @BeforeEach
+    void setUp() {
+        host = "https://localhost:" + wireMockServer.httpsPort();
+
+        clusterUuid = UUID.randomUUID().toString();
+        final Map<String, Object> responseBody = Map.of(
+                "name", "opensearch",
+                "cluster_name", "opensearch",
+                "cluster_uuid", clusterUuid,
+                "version", Map.of(
+                        "number", "2.10.0",
+                        "build_hash", "abcdefg",
+                        "build_date", "20241212",
+                        "build_type", "testing",
+                        "distribution", "datapreppertesting",
+                        "build_snapshot", "false",
+                        "lucene_version", "8",
+                        "minimum_wire_compatibility_version", "2.10.0",
+                        "minimum_index_compatibility_version", "2.10.0"
+                ),
+                "tagline", "You Know, for Search"
+        );
+        wireMockServer.stubFor(get("/").willReturn(jsonResponse(responseBody, 200)));
+    }
+
+    @Nested
+    class DefaultConfiguration {
+        private ConnectionConfiguration createObjectUnderTest() {
+            return new ConnectionConfiguration.Builder(Collections.singletonList(host))
+                    .build();
+        }
+
+        @Test
+        void createClient_will_not_trust_self_signed_certificates_by_default() {
+            final RestHighLevelClient client = createObjectUnderTest().createClient(awsCredentialsSupplier);
+            assertThat(client, notNullValue());
+
+            assertThrows(SSLHandshakeException.class, () -> client.info(RequestOptions.DEFAULT));
+        }
+
+        @Test
+        void createOpenSearchClient_will_not_trust_self_signed_certificates_by_default() {
+            final ConnectionConfiguration objectUnderTest = createObjectUnderTest();
+            final OpenSearchClient openSearchClient = objectUnderTest.createOpenSearchClient(objectUnderTest.createClient(awsCredentialsSupplier), awsCredentialsSupplier);
+            assertThat(openSearchClient, notNullValue());
+
+            assertThrows(SSLHandshakeException.class, openSearchClient::info);
+        }
+    }
+
+    @Nested
+    class DefaultSigV4Configuration {
+        @BeforeEach
+        void setUp() {
+            when(awsCredentialsSupplier.getProvider(any())).thenReturn(AnonymousCredentialsProvider.create());
+        }
+
+        private ConnectionConfiguration createObjectUnderTest() {
+            return new ConnectionConfiguration.Builder(Collections.singletonList(host))
+                    .withAwsSigv4(true)
+                    .withAwsRegion("us-east-1")
+                    .build();
+        }
+
+        @Test
+        void createClient_will_not_trust_self_signed_certificates_by_default() {
+            final RestHighLevelClient client = createObjectUnderTest().createClient(awsCredentialsSupplier);
+            assertThat(client, notNullValue());
+
+            assertThrows(SSLHandshakeException.class, () -> client.info(RequestOptions.DEFAULT));
+        }
+
+        @Test
+        void createOpenSearchClient_will_not_trust_self_signed_certificates_by_default() {
+            final ConnectionConfiguration objectUnderTest = createObjectUnderTest();
+            final OpenSearchClient openSearchClient = objectUnderTest.createOpenSearchClient(objectUnderTest.createClient(awsCredentialsSupplier), awsCredentialsSupplier);
+            assertThat(openSearchClient, notNullValue());
+
+            assertThrows(SSLHandshakeException.class, openSearchClient::info);
+        }
+    }
+
+    @Nested
+    class InsecureConfiguration {
+        private ConnectionConfiguration createObjectUnderTest() {
+            return new ConnectionConfiguration.Builder(Collections.singletonList(host))
+                    .withInsecure(true)
+                    .build();
+        }
+
+        @Test
+        void createClient_will_trust_self_signed_certificates_if_insecure() throws IOException {
+            final RestHighLevelClient client = createObjectUnderTest().createClient(awsCredentialsSupplier);
+            assertThat(client, notNullValue());
+
+            final MainResponse infoResponse = client.info(RequestOptions.DEFAULT);
+
+            assertThat(infoResponse, notNullValue());
+            assertThat(infoResponse.getClusterName(), equalTo("opensearch"));
+            assertThat(infoResponse.getClusterUuid(), equalTo(clusterUuid));
+        }
+
+
+        @Test
+        void createOpenSearchClient_will_trust_self_signed_certificates_if_insecure() throws IOException {
+            final ConnectionConfiguration objectUnderTest = createObjectUnderTest();
+            final OpenSearchClient openSearchClient = objectUnderTest.createOpenSearchClient(objectUnderTest.createClient(awsCredentialsSupplier), awsCredentialsSupplier);
+            assertThat(openSearchClient, notNullValue());
+
+            final InfoResponse infoResponse = openSearchClient.info();
+
+            assertThat(infoResponse, notNullValue());
+            assertThat(infoResponse.clusterName(), equalTo("opensearch"));
+            assertThat(infoResponse.clusterUuid(), equalTo(clusterUuid));
+        }
+    }
+}
\ No newline at end of file

@@ -150,7 +150,6 @@ void testCreateOpenSearchClientAwsServerlessDefault() throws IOException {
         when(awsCredentialsSupplier.getProvider(any())).thenReturn(awsCredentialsProvider);
 
         final RestHighLevelClient client = connectionConfiguration.createClient(awsCredentialsSupplier);
-        when(apacheHttpClientBuilder.tlsTrustManagersProvider(any())).thenReturn(apacheHttpClientBuilder);
         when(apacheHttpClientBuilder.build()).thenReturn(apacheHttpClient);
         final OpenSearchClient openSearchClient;
         try (final MockedStatic<ApacheHttpClient> apacheHttpClientMockedStatic = mockStatic(ApacheHttpClient.class)) {
@@ -160,7 +159,6 @@ void testCreateOpenSearchClientAwsServerlessDefault() throws IOException {
         assertNotNull(openSearchClient);
         assertThat(openSearchClient._transport(), instanceOf(AwsSdk2Transport.class));
         assertThat(openSearchClient._transport().jsonpMapper(), instanceOf(PreSerializedJsonpMapper.class));
-        verify(apacheHttpClientBuilder).tlsTrustManagersProvider(any());
         verify(apacheHttpClientBuilder).build();
         openSearchClient.shutdown();
         client.close();

@@ -27,6 +27,8 @@
 import software.amazon.awssdk.regions.Region;
 
 import javax.net.ssl.SSLContext;
+import javax.net.ssl.TrustManager;
+
 import java.nio.file.Path;
 import java.time.Duration;
 import java.util.Collections;
@@ -41,6 +43,7 @@
 import static org.mockito.Mockito.mock;
 import static org.mockito.Mockito.mockStatic;
 import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;
 import static org.mockito.Mockito.verifyNoInteractions;
 import static org.mockito.Mockito.when;
@@ -409,9 +412,40 @@ void createSdkAsyncHttpClient_with_self_signed_certificate() {
         lenient().when(openSearchSourceConfiguration.getConnectionConfiguration()).thenReturn(connectionConfiguration);
         lenient().when(connectionConfiguration.getCertPath()).thenReturn(path);
         try (MockedStatic<TrustStoreProvider> trustStoreProviderMockedStatic = mockStatic(TrustStoreProvider.class)) {
+            TrustManager[] mockTrustManagers = new TrustManager[] { mock(TrustManager.class) };
+            trustStoreProviderMockedStatic.when(() -> TrustStoreProvider.createTrustManager(path)).thenReturn(mockTrustManagers);
             final SdkAsyncHttpClient sdkAsyncHttpClient = createObjectUnderTest().createSdkAsyncHttpClient(openSearchSourceConfiguration);
             assertThat(sdkAsyncHttpClient, notNullValue());
             trustStoreProviderMockedStatic.verify(() -> TrustStoreProvider.createTrustManager(path));
         }
     }
+    @Test
+    void createSdkAsyncHttpClient_with_secure_configuration_and_no_cert_path_does_not_trust_all_managers() {
+        when(connectionConfiguration.getCertPath()).thenReturn(null);
+        when(connectionConfiguration.isInsecure()).thenReturn(false);
+        when(connectionConfiguration.getConnectTimeout()).thenReturn(Duration.ofSeconds(30));
+        try (MockedStatic<TrustStoreProvider> trustStoreProviderMockedStatic = mockStatic(TrustStoreProvider.class)) {
+            final SdkAsyncHttpClient sdkAsyncHttpClient = createObjectUnderTest().createSdkAsyncHttpClient(openSearchSourceConfiguration);
+            assertThat(sdkAsyncHttpClient, notNullValue());
+            trustStoreProviderMockedStatic.verify(() -> TrustStoreProvider.createTrustAllManager(), never());
+            trustStoreProviderMockedStatic.verify(() -> TrustStoreProvider.createTrustManager(any(Path.class)), never());
+        }
+    }
+    
+    @Test
+    void createSdkAsyncHttpClient_with_insecure_configuration_and_no_cert_path_trusts_all_managers() {
+        when(connectionConfiguration.getCertPath()).thenReturn(null);
+        when(connectionConfiguration.isInsecure()).thenReturn(true);
+        when(connectionConfiguration.getConnectTimeout()).thenReturn(Duration.ofSeconds(30));
+        try (MockedStatic<TrustStoreProvider> trustStoreProviderMockedStatic = mockStatic(TrustStoreProvider.class)) {
+            TrustManager[] mockTrustManagers = new TrustManager[] { mock(TrustManager.class) };
+            trustStoreProviderMockedStatic.when(() -> TrustStoreProvider.createTrustAllManager())
+                    .thenReturn(mockTrustManagers);
+            final SdkAsyncHttpClient sdkAsyncHttpClient = createObjectUnderTest().createSdkAsyncHttpClient(openSearchSourceConfiguration);
+            assertThat(sdkAsyncHttpClient, notNullValue());
+            trustStoreProviderMockedStatic.verify(() -> TrustStoreProvider.createTrustAllManager(), times(1));
+            trustStoreProviderMockedStatic.verify(() -> TrustStoreProvider.createTrustManager(any(Path.class)), never());
+        }
+    }
+
 }

@@ -132,6 +132,7 @@ private RestHighLevelClient prepareOpenSearchRestHighLevelClient() {
                 Collections.singletonList("https://127.0.0.1:9200"));
         builder.withUsername("admin");
         builder.withPassword("admin");
+        builder.withInsecure(true);
         return builder.build().createClient(null);
     }
 

@@ -100,6 +100,7 @@ private RestHighLevelClient prepareOpenSearchRestHighLevelClient() {
                 Collections.singletonList("https://127.0.0.1:9200"));
         builder.withUsername("admin");
         builder.withPassword("admin");
+        builder.withInsecure(true);
         final AwsCredentialsSupplier awsCredentialsSupplier = mock(AwsCredentialsSupplier.class);
         return builder.build().createClient(awsCredentialsSupplier);
     }

@@ -11,5 +11,6 @@ grok-pipeline:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index: "test-grok-index-%{yyyy.MM.dd}"
         flush_timeout: 5000

@@ -17,5 +17,6 @@ grok-pipeline:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "${{aws_secrets:opensearch-sink:username}}"
         password: "${{aws_secrets:opensearch-sink:password}}"
+        insecure: true
         index: "test-grok-index"
         flush_timeout: 5000
\ No newline at end of file

@@ -12,5 +12,6 @@ grok-pipeline:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index: "test-grok-index"
         flush_timeout: 5000

@@ -22,6 +22,7 @@ pipeline2:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index: "test-substitute-index"
         flush_timeout: 5000
 
@@ -38,5 +39,6 @@ pipeline3:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index: "test-grok-index"
         flush_timeout: 5000

@@ -181,6 +181,7 @@ private RestHighLevelClient prepareOpenSearchRestHighLevelClient() {
                 Collections.singletonList("https://127.0.0.1:9200"));
         builder.withUsername("admin");
         builder.withPassword("admin");
+        builder.withInsecure(true);
         final AwsCredentialsSupplier awsCredentialsSupplier = mock(AwsCredentialsSupplier.class);
         return builder.build().createClient(awsCredentialsSupplier);
     }

@@ -117,6 +117,7 @@ private RestHighLevelClient prepareOpenSearchRestHighLevelClient() {
                 Collections.singletonList("https://127.0.0.1:9200"));
         builder.withUsername("admin");
         builder.withPassword("admin");
+        builder.withInsecure(true);
         final AwsCredentialsSupplier awsCredentialsSupplier = mock(AwsCredentialsSupplier.class);
         return builder.build().createClient(awsCredentialsSupplier);
     }

@@ -12,5 +12,6 @@ aggregate-pipeline:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index: "test-peer-forwarder-index"
         flush_timeout: 5000
\ No newline at end of file

@@ -16,5 +16,6 @@ aggregate-pipeline:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index: "test-log-metrics-index"
         flush_timeout: 5000

@@ -115,6 +115,7 @@ public void testPipelineEndToEnd() {
                 Collections.singletonList("https://127.0.0.1:9200"));
         builder.withUsername("admin");
         builder.withPassword("admin");
+        builder.withInsecure(true);
         final RestHighLevelClient restHighLevelClient = builder.build().createClient(null);
         // Wait for data to flow through pipeline and be indexed by ES
         await().atLeast(3, TimeUnit.SECONDS).atMost(20, TimeUnit.SECONDS).untilAsserted(

@@ -81,6 +81,7 @@ public void testPipelineEndToEnd() {
                 Collections.singletonList("https://127.0.0.1:9200"));
         builder.withUsername("admin");
         builder.withPassword("admin");
+        builder.withInsecure(true);
         final AwsCredentialsSupplier awsCredentialsSupplier = mock(AwsCredentialsSupplier.class);
         final RestHighLevelClient restHighLevelClient = builder.build().createClient(awsCredentialsSupplier);
 

@@ -18,5 +18,6 @@ raw-pipeline:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index_type: trace-analytics-raw
         flush_timeout: 5000
\ No newline at end of file

@@ -18,5 +18,6 @@ raw-pipeline:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index_type: trace-analytics-raw
         flush_timeout: 5000

@@ -16,10 +16,12 @@ raw-pipeline:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
   sink:
     - opensearch:
         hosts: [ "https://node-0.example.com:9200" ]
         username: "admin"
         password: "admin"
+        insecure: true
         index_type: trace-analytics-raw
         flush_timeout: 5000

@@ -18,5 +18,6 @@ service-map-pipeline:
         hosts: ["https://node-0.example.com:9200"]
         username: "admin"
         password: "admin"
+        insecure: true
         index_type: trace-analytics-service-map
         flush_timeout: 5000

@@ -5,50 +5,7 @@
 
 package org.opensearch.dataprepper.plugins.geoip.extension.databasedownload;
 
-import javax.net.ssl.HostnameVerifier;
-import javax.net.ssl.HttpsURLConnection;
-import javax.net.ssl.SSLContext;
-import javax.net.ssl.SSLSession;
-import javax.net.ssl.TrustManager;
-import javax.net.ssl.X509TrustManager;
-import java.security.KeyManagementException;
-import java.security.NoSuchAlgorithmException;
-import java.security.SecureRandom;
-import java.security.cert.CertificateException;
-import java.security.cert.X509Certificate;
-
 public interface DBSource {
     String MAXMIND_DATABASE_EXTENSION = ".mmdb";
     void initiateDownload() throws Exception;
-
-    /**
-     * initiateSSL
-     * @throws NoSuchAlgorithmException NoSuchAlgorithmException
-     * @throws KeyManagementException KeyManagementException
-     */
-    default void initiateSSL() throws NoSuchAlgorithmException, KeyManagementException {
-        final TrustManager[] trustAllCerts = new TrustManager[]{
-                new X509TrustManager() {
-                    public X509Certificate[] getAcceptedIssuers() {
-                        return null;
-                    }
-                    public void checkServerTrusted(X509Certificate[] certs, String authType) throws CertificateException {
-                        return;
-                    }
-                    public void checkClientTrusted(X509Certificate[] certs, String authType) throws CertificateException {
-                        return;
-                    }
-                }
-        };
-
-        final SSLContext sc = SSLContext.getInstance("TLS");
-        sc.init(null, trustAllCerts, new SecureRandom());
-        HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
-        final HostnameVerifier hostnameVerifier = new HostnameVerifier() {
-            public boolean verify(String urlHostName, SSLSession session) {
-                return true;
-            }
-        };
-        HttpsURLConnection.setDefaultHostnameVerifier(hostnameVerifier);
-    }
 }

@@ -53,7 +53,6 @@ public void initiateDownload() {
         for (final String key: databasePaths) {
             geoIPFileManager.createDirectoryIfNotExist(tarDir);
             try {
-                initiateSSL();
                 buildRequestAndDownloadFile(maxMindDatabaseConfig.getDatabasePaths().get(key), downloadTarFilepath);
                 final File tarFile = decompressAndgetTarFile(tarDir, downloadTarFilepath);
                 unTarFile(tarFile, new File(destinationDirectory), key);

@@ -41,7 +41,7 @@ public void checkClientTrusted(X509Certificate[] certs, String authType) throws
                 }
         };
 
-        final SSLContext sc = SSLContext.getInstance("SSL");
+        final SSLContext sc = SSLContext.getInstance("TLS");
         sc.init(null, trustAllCerts, new SecureRandom());
         HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
         final HostnameVerifier hostnameVerifier = new HostnameVerifier() {

@@ -40,7 +40,7 @@ private TrustManager[] getTrustManager() {
     @Override
     public SSLEngine createClientSslEngine(final String peerHost, final int peerPort, final String endpointIdentification) {
         try {
-            final SSLContext sslContext = SSLContext.getInstance("SSL");
+            final SSLContext sslContext = SSLContext.getInstance("TLS");
             sslContext.init(null, getTrustManager(), new SecureRandom());
             SSLEngine sslEngine = sslContext.createSSLEngine(peerHost, peerPort);
             sslEngine.setUseClientMode(true);

@@ -39,7 +39,7 @@ public void checkServerTrusted(X509Certificate[] certs, String authType) {
     public SSLEngine createClientSslEngine(String peerHost, int peerPort, String endpointIdentification) {
         TrustManager[] trustManagers = new TrustManager[]{ INSECURE_TRUST_MANAGER };
         try {
-            SSLContext sslContext = SSLContext.getInstance("SSL");
+            SSLContext sslContext = SSLContext.getInstance("TLS");
             sslContext.init(null, trustManagers, new SecureRandom());
             SSLEngine sslEngine = sslContext.createSSLEngine(peerHost, peerPort);
             sslEngine.setUseClientMode(true);