Spring/spring-boot
Spring/spring-boot
1
0
Fork 0
mirror of https://github.com/spring-projects/spring-boot.git synced 2024-08-29 03:06:45 +08:00
Code Issues Packages Projects Releases Wiki Activity

Apply key property to the keystore and not to the truststore

Browse Source 
Update `PropertiesSslBundle` so that key properties are now
only applied to the keystore and not the truststore.

Closes gh-38125
This commit is contained in:
Phillip Webb 2023-10-30 17:42:10 -07:00
parent 5dc5c2a4bc
commit 30a7426e86
3 changed files with 14 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
spring-boot-project/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/ssl/PropertiesSslBundle.java
View File

@ -112,14 +112,18 @@ public final class PropertiesSslBundle implements SslBundle {
} }
private static SslStoreBundle asSslStoreBundle(PemSslBundleProperties properties) { private static SslStoreBundle asSslStoreBundle(PemSslBundleProperties properties) {
PemSslStore keyStore = asPemSslStore(properties.getKeystore(), properties.getKey().getAlias()); PemSslStore keyStore = asPemSslStore(properties.getKeystore());
PemSslStore trustStore = asPemSslStore(properties.getTruststore(), properties.getKey().getAlias()); if (keyStore != null) {
keyStore = keyStore.withAlias(properties.getKey().getAlias())
.withPassword(properties.getKey().getPassword());
}
PemSslStore trustStore = asPemSslStore(properties.getTruststore());
return new PemSslStoreBundle(keyStore, trustStore); return new PemSslStoreBundle(keyStore, trustStore);
} }
private static PemSslStore asPemSslStore(PemSslBundleProperties.Store properties, String alias) { private static PemSslStore asPemSslStore(PemSslBundleProperties.Store properties) {
try { try {
PemSslStoreDetails details = asStoreDetails(properties, alias); PemSslStoreDetails details = asStoreDetails(properties);
PemSslStore pemSslStore = PemSslStore.load(details); PemSslStore pemSslStore = PemSslStore.load(details);
if (properties.isVerifyKeys()) { if (properties.isVerifyKeys()) {
CertificateMatcher certificateMatcher = new CertificateMatcher(pemSslStore.privateKey()); CertificateMatcher certificateMatcher = new CertificateMatcher(pemSslStore.privateKey());
@ -133,9 +137,9 @@ public final class PropertiesSslBundle implements SslBundle {
} }
} }
private static PemSslStoreDetails asStoreDetails(PemSslBundleProperties.Store properties, String alias) { private static PemSslStoreDetails asStoreDetails(PemSslBundleProperties.Store properties) {
return new PemSslStoreDetails(properties.getType(), alias, null, properties.getCertificate(), return new PemSslStoreDetails(properties.getType(), properties.getCertificate(), properties.getPrivateKey(),
properties.getPrivateKey(), properties.getPrivateKeyPassword()); properties.getPrivateKeyPassword());
} }
private static SslStoreBundle asSslStoreBundle(JksSslBundleProperties properties) { private static SslStoreBundle asSslStoreBundle(JksSslBundleProperties properties) {

4
spring-boot-project/spring-boot-autoconfigure/src/test/java/org/springframework/boot/autoconfigure/ssl/PropertiesSslBundleTests.java
View File

@ -66,10 +66,10 @@ class PropertiesSslBundleTests {
Certificate certificate = sslBundle.getStores().getKeyStore().getCertificate("alias"); Certificate certificate = sslBundle.getStores().getKeyStore().getCertificate("alias");
assertThat(certificate).isNotNull(); assertThat(certificate).isNotNull();
assertThat(certificate.getType()).isEqualTo("X.509"); assertThat(certificate.getType()).isEqualTo("X.509");
Key key = sslBundle.getStores().getKeyStore().getKey("alias", null); Key key = sslBundle.getStores().getKeyStore().getKey("alias", "secret".toCharArray());
assertThat(key).isNotNull(); assertThat(key).isNotNull();
assertThat(key.getAlgorithm()).isEqualTo("RSA"); assertThat(key.getAlgorithm()).isEqualTo("RSA");
certificate = sslBundle.getStores().getTrustStore().getCertificate("alias"); certificate = sslBundle.getStores().getTrustStore().getCertificate("ssl");
assertThat(certificate).isNotNull(); assertThat(certificate).isNotNull();
assertThat(certificate.getType()).isEqualTo("X.509"); assertThat(certificate.getType()).isEqualTo("X.509");
} }

3
spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/server/WebServerSslBundle.java
View File

@ -65,8 +65,7 @@ public final class WebServerSslBundle implements SslBundle {
ssl.getCertificatePrivateKey()) ssl.getCertificatePrivateKey())
.withAlias(ssl.getKeyAlias()); .withAlias(ssl.getKeyAlias());
PemSslStoreDetails trustStoreDetails = new PemSslStoreDetails(ssl.getTrustStoreType(), PemSslStoreDetails trustStoreDetails = new PemSslStoreDetails(ssl.getTrustStoreType(),
ssl.getTrustCertificate(), ssl.getTrustCertificatePrivateKey()) ssl.getTrustCertificate(), ssl.getTrustCertificatePrivateKey());
.withAlias(ssl.getKeyAlias());
return new PemSslStoreBundle(keyStoreDetails, trustStoreDetails); return new PemSslStoreBundle(keyStoreDetails, trustStoreDetails);
} }