KeyStore and TrustStore are mandatory in SslStoreProvider

[jonatan-ivanov]

The getKeyStore and the getTrustStore methods of the SslStoreProvider interface must always return the desired Key- and TrustStore object (at least in case of using Tomcat, I haven't tested Jetty and Undertow but it seems their case is the same). In other words, there is no way to specify just one of them, e.g.: I want to specify which KeyStore to use but I want to use the default TrustStore shipped with the JDK. Or I want to mess with the TrustStore but I still want to use the KeyStore I configured in the application properties.

I'm using Spring-Boot 1.5.9-RELEASE, OpenJDK 1.8.0_152 and Gradle 4.4

In case of Tomcat, I think this could be fixed in the TomcatEmbeddedServletContainerFactory by just setting the right objects in the right scenarios (see an example below).

The solution in case of Jetty and Undertow seems similar or even simpler to me. I created an example which reproduces the issue, please check the commit which tries to set the TrustStore to make this work.

if (getSslStoreProvider() != null) {
    TomcatURLStreamHandlerFactory instance = TomcatURLStreamHandlerFactory
            .getInstance();
    instance.addUserFactory(
            new SslStoreProviderUrlStreamHandlerFactory(getSslStoreProvider()));

    if (getSslStoreProvider().getKeyStore() != null) {
        protocol.setKeystoreFile(
                SslStoreProviderUrlStreamHandlerFactory.KEY_STORE_URL);
    }
    else {
        configureSslKeyStore(protocol, ssl);
    }

    if (getSslStoreProvider().getTrustStore() != null) {
        protocol.setTruststoreFile(
                SslStoreProviderUrlStreamHandlerFactory.TRUST_STORE_URL);
    }
    else {
        configureSslTrustStore(protocol, ssl);
    }
}
else {
    configureSslKeyStore(protocol, ssl);
    configureSslTrustStore(protocol, ssl);
}

If this approach could work, I'm happy to create a PR.

[jonatan-ivanov]

@philwebb Could you please check this issue?

[philwebb]

@jonatan-ivanov Sorry for the delay in replying. I think this could be considered a bug but I'm tempted to only attempt the fix in 2.0.x since a lot of the code has changed around this. The org.springframework.boot.web.embedded.tomcat.SslServerCustomizer class is not responsible for setting up SSL.

I wonder if we can just always call configureSslKeyStore/configureSslTrustStore first then call configureSslStoreProvider to replace the URL if needed?