feat: add OTLP TLS parameters

pom.xml

@@ -4,7 +4,7 @@
     <modelVersion>4.0.0</modelVersion>
     <groupId>com.avioconsulting.mule</groupId>
     <artifactId>mule-opentelemetry-module</artifactId>
-    <version>2.1.2-SNAPSHOT</version>
+    <version>2.2.0-SNAPSHOT</version>
     <packaging>mule-extension</packaging>
 
     <parent>

src/docs/asciidoc/module-config.adoc

@@ -111,7 +111,23 @@ For example, if opentelemetry collector is listening on localhost:4317, then set
 
 NOTE: When configuring the OTLP Exporter with *GRPC protocol*, OpenTelemetry collector endpoint *must be set to the base endpoint* of OTEL collector. For example, if opentelemetry collector is listening on localhost:4317, then set `collectorEndpoint=http://localhost:4317` and *NOT* [.line-through]#`collectorEndpoint=http://localhost:4317/v1`#.
 
-image::module-otel-exporter-config.png[]
+image::module-otel-exporter-config.png[alt="OTEL OTLP Exporter configuration"]
+
+===== Configuring TLS for Exporter Endpoint
+
+If OTLP collector endpoint is using HTTPS, this exporter may require additional configuration when non-public CA certified certificates are used.
+
+Following attributes can be used to configure certificates on OTLP Exporter -
+
+**Server (Receiver Endpoint) Certificates**:
+
+- `endpointCertPath` - The path to the file containing trusted certificates to use when verifying an OTLP trace, metric, or log server's TLS credentials. The file should contain one or more (Server, CA chain etc.) X.509 certificates in PEM format. By default, the host platform's trusted root certificates are used. For example, if file is included in `src/main/resources/certs/server-certs.pem`, set this attribute to `certs/server-certs.pem`.
+
+**Client (Mule app) Certificates**:
+
+- `clientCertPath` - The path to the file containing trusted certificates to use when verifying an OTLP trace, metric, or log client's TLS credentials. The file should contain one or more X.509 certificates in PEM format. By default, no chain file is used.
+
+- `clientCertKeyPath` - The path to the file containing private client key to use when verifying an OTLP trace, metric, or log client's TLS credentials. The file should contain one private key *PKCS8 PEM* format. By default, no client key is used.
 
 ===== Troubleshooting
 

src/main/java/com/avioconsulting/mule/opentelemetry/api/config/exporter/AbstractExporter.java

@@ -4,12 +4,19 @@
 import org.mule.runtime.extension.api.annotation.param.Optional;
 import org.mule.runtime.extension.api.annotation.param.Parameter;
 import org.mule.runtime.extension.api.annotation.param.display.Summary;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 
+import java.nio.file.Files;
+import java.nio.file.Paths;
 import java.util.HashMap;
 import java.util.Map;
+import java.util.Objects;
 
 public abstract class AbstractExporter implements OpenTelemetryExporter {
 
+  private static final Logger LOGGER = LoggerFactory.getLogger(AbstractExporter.class);
+
   @Parameter
   @NullSafe
   @Optional
@@ -34,4 +41,29 @@ public Map<String, String> getExporterProperties() {
     return config;
   }
 
+  /**
+   * When paths are provided relative to the mule application code, the OTEL SDK
+   * resolution fails to find those files.
+   * This method leverages classpath to find the absolute path.
+   *
+   * @param propertyName
+   *            {@link String} property to transform form
+   * @param path
+   *            {@link String} path to transform
+   * @return transformed path or same path if exists
+   */
+  protected String transformToAbsolutePath(String propertyName, String path) {
+    if (path != null && !path.isEmpty()) {
+      if (Files.exists(Paths.get(path))) {
+        LOGGER.debug("{} path exists - {}", propertyName, path);
+        return path;
+      } else {
+        String absolutePath = Objects.requireNonNull(this.getClass().getClassLoader().getResource(path),
+            path + " not found on the classpath").getPath();
+        LOGGER.info("Transforming {} from {} to absolute path {}", propertyName, path, absolutePath);
+        return absolutePath;
+      }
+    }
+    return path;
+  }
 }

src/main/java/com/avioconsulting/mule/opentelemetry/api/config/exporter/OtlpExporter.java

@@ -2,11 +2,13 @@
 
 import com.avioconsulting.mule.opentelemetry.api.config.Header;
 import com.avioconsulting.mule.opentelemetry.api.config.KeyValuePair;
+import org.mule.runtime.api.meta.model.display.PathModel;
 import org.mule.runtime.extension.api.annotation.param.NullSafe;
 import org.mule.runtime.extension.api.annotation.param.Optional;
 import org.mule.runtime.extension.api.annotation.param.Parameter;
 import org.mule.runtime.extension.api.annotation.param.display.DisplayName;
 import org.mule.runtime.extension.api.annotation.param.display.Example;
+import org.mule.runtime.extension.api.annotation.param.display.Path;
 import org.mule.runtime.extension.api.annotation.param.display.Summary;
 
 import java.util.Arrays;
@@ -26,6 +28,9 @@ public class OtlpExporter extends AbstractExporter {
   public static final String OTEL_EXPORTER_OTLP_LOGS_ENDPOINT = "otel.exporter.otlp.logs.endpoint";
   public static final String OTEL_EXPORTER_OTLP_COMPRESSION = "otel.exporter.otlp.compression";
   public static final String OTEL_EXPORTER_OTLP_HEADERS = "otel.exporter.otlp.headers";
+  public static final String OTEL_EXPORTER_OTLP_CERTIFICATE = "otel.exporter.otlp.certificate";
+  public static final String OTEL_EXPORTER_OTLP_CLIENT_KEY = "otel.exporter.otlp.client.key";
+  public static final String OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE = "otel.exporter.otlp.client.certificate";
   @Parameter
   @Optional
   @Summary(value = "The OTLP traces, metrics, and logs endpoint to connect to. Must be a URL with a scheme of either http or https based on the use of TLS."
@@ -45,6 +50,27 @@ public class OtlpExporter extends AbstractExporter {
   @Summary("The compression type to use on OTLP trace, metric, and log requests.")
   private OtlpRequestCompression requestCompression;
 
+  @Parameter
+  @Optional
+  @Path(type = PathModel.Type.FILE, acceptedFileExtensions = { "pem" }, location = PathModel.Location.EMBEDDED)
+  @DisplayName(value = "Endpoint Certificate Path")
+  @Summary("The path to the file containing trusted certificates to use when verifying an OTLP trace, metric, or log server's TLS credentials. The file should contain one or more X.509 certificates in PEM format. By default the host platform's trusted root certificates are used.")
+  private String endpointCertPath;
+
+  @Parameter
+  @Optional
+  @Path(type = PathModel.Type.FILE, acceptedFileExtensions = { "pem" }, location = PathModel.Location.EMBEDDED)
+  @DisplayName(value = "Client Certificate Path")
+  @Summary("The path to the file containing trusted certificates to use when verifying an OTLP trace, metric, or log client's TLS credentials. The file should contain one or more X.509 certificates in PEM format. By default no chain file is used.")
+  private String clientCertPath;
+
+  @Parameter
+  @Optional
+  @Path(type = PathModel.Type.FILE, acceptedFileExtensions = { "pem" }, location = PathModel.Location.EMBEDDED)
+  @DisplayName(value = "Client Certificate Key Path")
+  @Summary("The path to the file containing private client key to use when verifying an OTLP trace, metric, or log client's TLS credentials. The file should contain one private key PKCS8 PEM format. By default no client key is used.")
+  private String clientCertKeyPath;
+
   @Parameter
   @DisplayName("Headers")
   @Optional
@@ -64,6 +90,18 @@ public String getCollectorEndpoint() {
     return collectorEndpoint;
   }
 
+  public String getEndpointCertPath() {
+    return endpointCertPath;
+  }
+
+  public String getClientCertPath() {
+    return clientCertPath;
+  }
+
+  public String getClientCertKeyPath() {
+    return clientCertKeyPath;
+  }
+
   /**
    * Default constructor used by Mule SDK to instantiate this class.
    */
@@ -73,7 +111,7 @@ public OtlpExporter() {
 
   /**
    * Constructor used for testing purpose.
-   * 
+   *
    * @param collectorEndpoint
    *            where span are delivered.
    * @param protocol
@@ -85,10 +123,36 @@ public OtlpExporter() {
    */
   OtlpExporter(String collectorEndpoint, Protocol protocol, OtlpRequestCompression requestCompression,
       List<Header> headers) {
+    this(collectorEndpoint, protocol, requestCompression, headers, null, null, null);
+  }
+
+  /**
+   * Constructor used for testing purpose.
+   *
+   * @param collectorEndpoint
+   *            where span are delivered.
+   * @param protocol
+   *            {@link Protocol} used by the collector
+   * @param requestCompression
+   *            {@link OtlpRequestCompression} to use for request compression
+   * @param headers
+   *            {@link List} of {@link Header} elements to send to collector
+   * @param endpointCertPath
+   *            {@link String} OTLP Endpoint Certificate Path
+   * @param clientCertKeyPath
+   *            {@link String} OTLP Client Certificate Key Path
+   * @param clientCertPath
+   *            {@link String} OTLP Client Certificate Path
+   */
+  OtlpExporter(String collectorEndpoint, Protocol protocol, OtlpRequestCompression requestCompression,
+      List<Header> headers, String endpointCertPath, String clientCertKeyPath, String clientCertPath) {
     this.collectorEndpoint = collectorEndpoint;
     this.protocol = protocol;
     this.requestCompression = requestCompression;
     this.headers = headers;
+    this.endpointCertPath = endpointCertPath;
+    this.clientCertPath = clientCertPath;
+    this.clientCertKeyPath = clientCertKeyPath;
   }
 
   public Map<String, String> getExporterProperties() {
@@ -108,6 +172,18 @@ public Map<String, String> getExporterProperties() {
       config.put(OTEL_EXPORTER_OTLP_COMPRESSION, requestCompression.getValue());
     }
     config.put(OTEL_EXPORTER_OTLP_HEADERS, KeyValuePair.commaSeparatedList(getHeaders()));
+    if (getEndpointCertPath() != null) {
+      config.put(OTEL_EXPORTER_OTLP_CERTIFICATE,
+          transformToAbsolutePath(OTEL_EXPORTER_OTLP_CERTIFICATE, getEndpointCertPath()));
+    }
+    if (getClientCertKeyPath() != null) {
+      config.put(OTEL_EXPORTER_OTLP_CLIENT_KEY,
+          transformToAbsolutePath(OTEL_EXPORTER_OTLP_CLIENT_KEY, getClientCertKeyPath()));
+    }
+    if (getClientCertPath() != null) {
+      config.put(OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE,
+          transformToAbsolutePath(OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE, getClientCertPath()));
+    }
     return config;
   }
 

src/test/java/com/avioconsulting/mule/opentelemetry/api/config/exporter/OtlpExporterTest.java

@@ -3,7 +3,9 @@
 import com.avioconsulting.mule.opentelemetry.api.config.Header;
 import org.junit.Test;
 
+import java.nio.file.Paths;
 import java.util.Collections;
+import java.util.Objects;
 
 import static com.avioconsulting.mule.opentelemetry.api.config.exporter.OtlpExporter.*;
 import static org.assertj.core.api.Assertions.assertThat;
@@ -36,4 +38,38 @@ public void verifyNoCompressionSet() {
         .doesNotContainKey(OTEL_EXPORTER_OTLP_COMPRESSION);
   }
 
+  @Test
+  public void verifyTransformedCertificatePaths() {
+    OtlpExporter otlpExporter = new OtlpExporter("http://localhost", OtlpExporter.Protocol.HTTP_PROTOBUF,
+        OtlpExporter.OtlpRequestCompression.NONE, Collections.emptyList(), "./certs/server-all-certs.pem",
+        "./certs/client-key-pkcs8.pem", "./certs/client-cert.pem");
+    assertThat(otlpExporter.getExporterProperties())
+        .containsEntry(OTEL_EXPORTER_OTLP_CERTIFICATE,
+            Objects.requireNonNull(
+                this.getClass().getClassLoader().getResource("./certs/server-all-certs.pem"))
+                .getPath())
+        .containsEntry(OTEL_EXPORTER_OTLP_CLIENT_KEY,
+            Objects.requireNonNull(
+                this.getClass().getClassLoader().getResource("./certs/client-key-pkcs8.pem"))
+                .getPath())
+        .containsEntry(OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE, Objects
+            .requireNonNull(this.getClass().getClassLoader().getResource("./certs/client-cert.pem"))
+            .getPath());
+  }
+
+  @Test
+  public void verifyNotTransformedCertificatePaths() {
+    String serverAllCert = Paths.get("src/test/resources/certs/server-all-certs.pem").toAbsolutePath().toString();
+    String clientKey = Paths.get("src/test/resources/certs/client-key-pkcs8.pem").toAbsolutePath().toString();
+    String clientCert = Paths.get("src/test/resources/certs/client-cert.pem").toAbsolutePath().toString();
+    OtlpExporter otlpExporter = new OtlpExporter("http://localhost", OtlpExporter.Protocol.HTTP_PROTOBUF,
+        OtlpExporter.OtlpRequestCompression.NONE, Collections.emptyList(), serverAllCert, clientKey,
+        clientCert);
+    assertThat(otlpExporter.getExporterProperties())
+        .containsEntry(OTEL_EXPORTER_OTLP_CERTIFICATE,
+            serverAllCert)
+        .containsEntry(OTEL_EXPORTER_OTLP_CLIENT_KEY, clientKey)
+        .containsEntry(OTEL_EXPORTER_OTLP_CLIENT_CERTIFICATE, clientCert);
+  }
+
 }

src/test/resources/certs/client-cert.pem

@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDOjCCAiKgAwIBAgIUEZSU28JMK4u4Tnkz5seQwvakf2UwDQYJKoZIhvcNAQEL
+BQAwGTEXMBUGA1UEChMOTXVsZSBPdGVsIEFwcHMwHhcNMjQwNTIyMDUwNzAwWhcN
+MjUwNTIyMDUwNzAwWjAZMRcwFQYDVQQKEw5NdWxlIE90ZWwgQXBwczCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBANz+3U5GW/n54hZZhuGY8gVDgJEmF3GW
+sOGXhjeVWzTCVEK1F9ju83cyrnYKnoHTnZTQWuEdNb3fnP/1L8nHN0KPb9s8W8hM
+pQifHTqDV5j4jAW63HxD3UBPxC8uV3X6dAsMZqsaISUGDxzwwsOOA/oMQF1WlAZq
+Og0ac7VcyB+5bMNNMRyaEPXHL81xF2BEFfFh8AfzMyZUVwAGNGctKjdrSAOJ1p0u
+73FlSIaL0Yzkhr1njGas3+kT3fy4yn2OsYf9wbFcr7XPrLVa5Knf7Tb1Qvno08Iq
+3wqn/WI/Et4aDAkaLHejAL9p8EedMeAME9qDXgm0teI2btYxmAKHfmMCAwEAAaN6
+MHgwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcD
+AjAMBgNVHRMBAf8EAjAAMB0GA1UdDgQWBBRumWof+qRazh6e5+WShV07tcNHhzAa
+BgNVHREEEzARgglsb2NhbGhvc3SHBH8AAAEwDQYJKoZIhvcNAQELBQADggEBAKY1
+d1Y7zTt8zRMIbYFJ409ZDMJ611X3lg/uU51UrUb/zYnWEpeSgSTG82tITDBCXawU
+26QwJrkGFvsES4mBMFUorXfl0O/rJKg0fBKt5B5PMCnmqXOzQ8nAmX/4saijxzUC
+uxK0CG2Jf9XIcr9o759f8yVqW0nv7x3uGHHhWNLqbfpNjMflgv7Mzl9pHLsGRQa8
+Q5zMJrPcfeFE9ATcxeKDhnwOsehyzvze0DLbRaDlcOnVzfrt/q5BdXFQf5tsdCmM
+cjGUaXNyDkzUKkr7nC5SeWInWiC0Vif5X0oy42UzR1fhBLhovKWmG1ATJEb2q2/r
+Rg66etsohKcW+rcGlWI=
+-----END CERTIFICATE-----

src/test/resources/certs/client-key-pkcs8.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQDc/t1ORlv5+eIW
+WYbhmPIFQ4CRJhdxlrDhl4Y3lVs0wlRCtRfY7vN3Mq52Cp6B052U0FrhHTW935z/
+9S/JxzdCj2/bPFvITKUInx06g1eY+IwFutx8Q91AT8QvLld1+nQLDGarGiElBg8c
+8MLDjgP6DEBdVpQGajoNGnO1XMgfuWzDTTEcmhD1xy/NcRdgRBXxYfAH8zMmVFcA
+BjRnLSo3a0gDidadLu9xZUiGi9GM5Ia9Z4xmrN/pE938uMp9jrGH/cGxXK+1z6y1
+WuSp3+029UL56NPCKt8Kp/1iPxLeGgwJGix3owC/afBHnTHgDBPag14JtLXiNm7W
+MZgCh35jAgMBAAECggEBAIj6+NXBytUBTGAqEe7XzHvywUg24iUoEG9kam8dhrEH
+Gw9WDHgMdKCXq4fDQUibkHtjQlFyt5L/feMxaPObJed93Ql5OjLHPyw+4/EW5D8P
+IEuU7YGg1w075BCSmuen3DHU9/ZqdczrGocHvNFVv6VH3sV8Grh3M5BXqwzpe6od
+L3IsUyI85TSIteroIcJ3TscKEeV4xT7ZogIM7Uu4ojYHj1PYMXWrpfZ5HoUC9IID
+yDA3lbPGn8rnNjz3DA9e0MzzJKeju+snSCFTkY1Qqh9mH9BFTHRX2BTQLnzVFIL0
+NEq8WjbKSMnYE0+7fB7DM4G3/JhzmOX1RaSCoJUzWtECgYEA3amy0jdRvUPBT/Yh
+XOqr+lg9olqRHEfLHjy9i4+UnQzTFZM2SXFmaFPybft4fMz5XndNZhS8xnqepTA/
++5anJavze4DxQVQjjleRLSB1Dq8RPHOhFUo4tliAEa3frN1QPnkEd3WjfszT/+5V
+Y10MfsqewuaFTdBGFMdxayriECcCgYEA/zqz3EBljyO2LSgNahrjldrakGfhZdxp
+u0RHqv5NojX9b7xejyNbWqwra6cCYbaNTn07xxaVZBnArMRfPaaX406/40fSpe81
+MRRYp0je9+PCgPhQdh+w16Kp+SjF/JIB1SHFPLICiQSECKz6i4hPFi8xIrQRKTd4
++BnDz5LkSWUCgYAyHyQrOo0GEeMNVKdYnkvC8N8G7hmv3mAEd1GY1B+Tn4m/cCkv
+VDAG2SyRR/KHrcWZYbqjoX7KFoH28kEVf4xODWKiA5cJ4Z+kmRJftN4jMtzf4XmE
+GeNXAA39cWaJbQWvCqhC5tvQWTp6vYabUDf6F5Dsmzl7TeP64No5lFnHswKBgCMo
+rwY0SMlDHiFyVwa61YcbMuiZps8lYdtOOKExjvg9f8AYrt4A/OCsvv6Bby6Ou0CI
+t+dhEQtNEOG723LetCW3/28LwdTh8u3j46KHw09arLyfeFYNX4sU+V09ZKi6ZE47
+7LPDwd2mJZocWhdGm75umdIyA/stjRiAVB0QGyqRAoGAIe5IlfSv+oT8TIy29hGt
+q9EUNm7dwHVHk3w/cjz80gJW8ekDBp7TzR/oYjsWg+DQ2MHR3EDHr0IY7vBEc34D
+2EaYA68y8r01B/QKoUBuHk/9Bwo1+Nnxb0e+eoPRlkwQ21xQaOnuOER/VdpOl+Wh
+72NpZpWSv8/bnVOsdOtxROU=
+-----END PRIVATE KEY-----

src/test/resources/certs/server-all-certs.pem

@@ -0,0 +1,39 @@
+-----BEGIN CERTIFICATE-----
+MIIDITCCAgmgAwIBAgIUdU2MqfaYaYud3k6M04qybyDBRFAwDQYJKoZIhvcNAQEL
+BQAwIDEeMBwGA1UEChMVT3BlblRlbGVtZXRyeSBFeGFtcGxlMB4XDTI0MDUyMjAz
+MTIwMFoXDTI5MDUyMTAzMTIwMFowIDEeMBwGA1UEChMVT3BlblRlbGVtZXRyeSBF
+eGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvLnBLTfIU9vL
+fMcpGdhMKUd4I+naHrTMLK/QFMc5U7mi6mH1jkI2YHNw86QwI5gJXaPcin9W6RCT
+JT2Ek3ECe8QQcuC/gvODZbR703X57uLXajw3q4MGmOSlimkZqyccYJTWH1S0Vnpu
+2J2gpACk0GqfqNx0PPysWhTsf334wegpaTg+0oT859Ye3q6dEPk6mXALYI8Dn1MP
+QBvoX5mHfjsYYwdnbtlyoIC2pE3GEtMAQkrWOBr6aO+Yh1v4MMimIGeoEwLFSmyr
+32r/HsaK/VKvytcag3MvXmF8BVAs672etl+Too0IoOf4p3yu3LhgzMxPucFQPJdY
+Qu+p/avvmQIDAQABo1MwUTAOBgNVHQ8BAf8EBAMCAQYwDwYDVR0TAQH/BAUwAwEB
+/zAdBgNVHQ4EFgQUJMgzr9s8gnItydNGHRni/chBN4UwDwYDVR0RBAgwBocEfwAA
+ATANBgkqhkiG9w0BAQsFAAOCAQEAP2rZt1cJjafXyzNFK85CWe94XuNEodS0bJhz
+S2TREZ48xYJ9eyn1zjsuq+ag0UcGAE+hF8LttYjD/xagWsScMwVvtpXEZMVxDAod
++w3OYzbkkg0GlcpKdvPfDQVya7HIjGhrEe75y6BmloU23IYnx6uOfXWF5CLyC1XF
+hI5idGBrlhn7GhojTl8Mfv/n5c0cfvT5SINTWtY2ezC3SWwC/nuVb38hoWbFBBIh
+k6jybIUXxpmFQzIqhB5k6JKwhKNPF0OH/hr6M883I73QKGHXvN/L8Mb+S/DnXOzi
+gC7l5dkWQ6D7DYxIqwqyRdV2yPzPi3z9yU+R7EeZCE6femOXyQ==
+-----END CERTIFICATE-----
+-----BEGIN CERTIFICATE-----
+MIIDSDCCAjCgAwIBAgIUCqaVh/BN+L+I5aU0w5PBd5xZzgIwDQYJKoZIhvcNAQEL
+BQAwIDEeMBwGA1UEChMVT3BlblRlbGVtZXRyeSBFeGFtcGxlMB4XDTI0MDUyMjAz
+MTIwMFoXDTI1MDUyMjAzMTIwMFowIDEeMBwGA1UEChMVT3BlblRlbGVtZXRyeSBF
+eGFtcGxlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0eGqMCnhFueB
+iV5xKe+4YtpbqBL9WQCutM6qEPROEAGlxP9+a1ULE2y4JVNjgO3vmVDqXznZyXll
+9K3tDLhFV/9RKafYnRNhb6edgEz5Ih7MBnSoTfNyw1zZIYSLPPGKUg7MmkErc4/B
+uua6m9vy5XZ23I+IvDGEkGlyIg3NdBOec/CAB8al8kCobXEGQJYwzUnlCmPvuYMp
+eoDiTnY5bkPxGaR26NNbLpClpJiZe7mLzJyljEz8l/tsNgbS0Lf7Sm/412mIXZhn
+q8uuHARpe2xm3Get0kM5vuROFyCxZ+PWzIEBfQIxKiWMC1ZbELYoMQLonFRFbSzi
+vPdqNcOOsQIDAQABo3oweDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYB
+BQUHAwEGCCsGAQUFBwMCMAwGA1UdEwEB/wQCMAAwHQYDVR0OBBYEFCdhL9Cjy/Hg
+CYYdIb1qq+Ci8j/UMBoGA1UdEQQTMBGCCWxvY2FsaG9zdIcEfwAAATANBgkqhkiG
+9w0BAQsFAAOCAQEAcEWjeDAs2l1JB95srWboKTTC8dqsrF79g0QVc4fGqZUEeK69
+WehklSIosVrxgkXWTky7R/7Ufp035gI0P5Pqb0zGC6RHr2nQjmhUl7orpz/yt5Ns
+7ojTJ7mt1ofFmBvpNABVmDRO6PEWq7MbhXe9hCBIh6EaS7nuPXe+g+Yl1ap3NrPq
+5BDcdqZ3fInFp3Q0DUh65s0avX4SWtRvjrKdZqWQGO2Lcyym9OlOVX17c66jKuDr
+nTW00rNSwQe6wzs/87JrhhOfm+2j36aqUWPAeJ2PTHHv7NDtCJDVTiC8Bb+ABNFG
+yHvltF3kNXbtRgzLJXitn+NM8Lykn/xF5jyRnw==
+-----END CERTIFICATE-----

src/test/resources/certs/server-ca-key.pem

@@ -0,0 +1,27 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpQIBAAKCAQEAvLnBLTfIU9vLfMcpGdhMKUd4I+naHrTMLK/QFMc5U7mi6mH1
+jkI2YHNw86QwI5gJXaPcin9W6RCTJT2Ek3ECe8QQcuC/gvODZbR703X57uLXajw3
+q4MGmOSlimkZqyccYJTWH1S0Vnpu2J2gpACk0GqfqNx0PPysWhTsf334wegpaTg+
+0oT859Ye3q6dEPk6mXALYI8Dn1MPQBvoX5mHfjsYYwdnbtlyoIC2pE3GEtMAQkrW
+OBr6aO+Yh1v4MMimIGeoEwLFSmyr32r/HsaK/VKvytcag3MvXmF8BVAs672etl+T
+oo0IoOf4p3yu3LhgzMxPucFQPJdYQu+p/avvmQIDAQABAoIBAQCff+4/pRFtrikA
+P+IAsclMadajo5RwtySH797QcL+GfzGtHTVHEbabNXWUtILq0ie4ODC/7HcrapKx
+upg9dBlBOKceL8wrhFrcrfio8uBUgOrGIjZ6gbYlqbgujjzfZaKaDbAZsqDnJXph
+IHcPpGumqTZepFKo6HNRfrWR2olOds+gjCWmFxH54yJfHSVe85KBXnog0MW6NwJO
+culWnzOdUebBZxf6fb0AjvSMRfS1m5R6AUHZ0uSDCD5FJVdZgs0g6HlhIOu5obyT
+HGOJH68RryT1A/mYA55hnJ2d93CQAe5CV3TrfDLhncQYo5UI6TwOdHL5sT0On9EI
+rUduS0QBAoGBAOou9ojpE+qQyRaZjRaGo2zTn92Vq/W7vG0yx9mAXunGKLhIr9wK
+AFb1/qeit71DYOuBsqEq8sU3CA+y7nNYZz0xMugkK138STw6nubwZFjA3mQJlXoG
+uIFTIVw1+B3eOnSqknPTf1pbzl4DQzus4a9LP6ex3uAz2JQcb763mkMhAoGBAM5O
+qw/rHulnWhtIlyR2XTEyDfLkz9VunOqcGostNTUTbmg45MjbwN96T4bGAcbK5XQa
+2AJX/fiQjuqpHN9++3TJUTXXKpztKdKa0/CEmHm0GMmsnqUu4+DEx5/mUcLiwdPH
+7L3iUAD+h3zFzLc4M/8jOPlisgYjDJnsDJeGsJV5AoGBAN3jQZTXwxctuFrBgv0k
+9RPYMFEzz4s2JoMQ6msbRtMZ/tsdhANpNoku6+rKMm4RuXNroGU03HIggnLdhzGj
+Qa6pPyLVooGa2YlHwefvPiUaGZ2PtyG33Hos2h8Uw9MJDTodpEY6zyA+fHp3fOy+
+EdiV4+pwjkzA0yUDDJ4YOQIBAoGBALvzm5CjCcRmLgcROPE1DG3XRjH1FwtA/KAY
+m24UP5cdHsbAnl4HJk3ypiUIm3G6QxRlqElqVKxxNmK+stlCXF/nUJ8WaXIR9rox
+58gFZMvrsXF6XAXtFBof7CXWtMIxx5fjWeEcHvro6BJaOcjp4SUdt7grnDhPEhng
+nRAm2xUxAoGAICWKMHjPfsVPVcORJN5TM2UU2agbv7zf/bcP2wanrb3ruSEJiRIx
+yNZiwvJczYOQL95kq87QrSCayFYTae2bVx39k9KF3LWaiJY9yfbjld58vrh8XHIh
+CdciJ1NfgwycIwZW0tnpa6p5jd8rdThEVeb+sTmumf8AWsHiH2fzMeg=
+-----END RSA PRIVATE KEY-----