Be able to use distributed references in openapi specification with certificate

[flfrolund]

Hi,

Currently when i try to validate my openapi specification i get an error that it can’t resolve distributed schema references. I get 403 and i guess it’s related to certificates not supported.

[daveshanley]

I don't know what you mean, can you give me an example? vacuum supports all local and remote references.

[flfrolund]

@daveshanley i can’t reference an yaml schema from an host behind certificate in my local openapi spefication.

Example:

myObject:
$ref: ”https://myhost/myObject”

[daveshanley]

There should be absolutely no reason why you can't use TLS/SSL in your references. Certificates are very much supported and TLS is active, You can see lots of demos of it in the tests. If your server has a valid SSL cert - it's all good.

However I think what you're asking about is needing some kind of custom http handling? As in you need to provide your own certs for custom auth?

There is this capability, but it's available via the developer APIs.

https://pb33f.io/libopenapi/rolodex/#add-a-custom-http-handler

https://pb33f.io/libopenapi/rolodex/#remote-references

[flfrolund]

I need the local cert to be accepted by the server i try to communicate with, then i need to be able to add it by example with environment variable reference.

[flfrolund]

Example of the issue:

[daveshanley]

So this is a genuine auth situation. You have custom certs locally that you want to use with a remote server running TLS.

Currently there is no way to do this using vacuum as a binary tool. You CAN do this using vacuum as a library, where you can programmatically wire up your own http handlers (see above).

however the ability to load in custom certs and use them with remote servers as part of vacuum as a tool does not yet exist, this would be a new feature that needs to be built.

It's not currently on my roadmap to be honest, as this is the first request I have ever had for it.

[flfrolund]

@daveshanley since i want to do as little work as possible with the implementation, i will then need to go with spectral. Was considering vacuum due to the speed but the decision would then still be spectral a the moment until some support of this is in place.

[daveshanley]

How does spectral handle it? I don't use spectral. It might be trivial to do. I'm not saying no, it's just an unknown to me. If you can help and understand how you want it to work, I can see how much effort it is to add it.

Because the machinery is all there. It's just not wired up the way you're expecting. So let's work together on this.

[flfrolund]

@daveshanley spectral solves it in a way that i don’t need to do anything, it just work by the box. They maybe search for certificates.