Improve SSL Key-Store load option to include Base64 encode String for certificates

[binoysankar]

Task List

• Steps to reproduce provided
• Stacktrace (if present) provided
• Example that reproduces the problem uploaded to Github
• Full description of the issue provided (see below)

Steps to Reproduce

I would like to include a "Feature/Improvement" instead of a "Bug" here.
We are using client SSL certificates to access the endpoints and below is the Micronaut configuration which I added in application.yml file

micronaut:
  application:
    name: sample-app
  http:
    client:
      ssl:
        key-store:
          type: PKCS12
          password: password
          path: classpath:624.LocalDev.pfx

This settings works perfectly fine, but my organizational policy doesn't permit to have any certificates in application classpath. We need to use Azure KeyVaults for our usecase. Usually for SpringBoot project we used to convert the certificates (.pfx) to base64 encoded string instead of certificate file directly.

Expected Behaviour

Request you to include a feature for loading the certificate file by having a 3rd option as base64 string. Currently "classpath: and file:" option is present if I am correct. ex: below

micronaut:
  application:
    name: sample-app
  http:
    client:
      ssl:
        key-store:
          type: PKCS12
          password: password
          encodedFile: MIIMCAIBAzCCC8QGCSqGSIb3DQEHAaCCC7UEgguxMI...

Actual Behaviour

Currently the keystore load method uses a URL option as below

 protected KeyStore load(Optional<String> optionalType,
                            String resource,
                            Optional<String> optionalPassword) throws Exception {
        String type = optionalType.orElse("JKS");
        String password = optionalPassword.orElse(null);
        KeyStore store = KeyStore.getInstance(type);

        Optional<URL> url = resourceResolver.getResource(resource);
        if (url.isPresent()) {
            store.load(url.get().openStream(), password == null ? null : password.toCharArray());
            return store;
        } else {
            throw new SslConfigurationException("The resource " + resource + " could not be found");
        }
    }

Template method to load a base64 certificate like below.

 private static KeyStore load(String pfxBase64, char[] storePassword, String storeType) {
        byte[] decodedString = Base64.getDecoder().decode(pfxBase64);

        try (InputStream internalStoreStream = new ByteArrayInputStream(decodedString)) {
            KeyStore store = KeyStore.getInstance(storeType != null ? storeType : KeyStore.getDefaultType());
            store.load(internalStoreStream, storePassword);
            return store;
        } catch (IOException | CertificateException | NoSuchAlgorithmException | KeyStoreException e) {
            throw new SslConfigurationException(ILLEGAL_ARGUMENT_ERROR_COULD_NOT_CREATE_INSTANCE, e);
        }
    }

Environment Information

• Operating System: All
• Micronaut Version: 2.3.3
• JDK Version: JDK 1.8 / 11

[dan-turner]

@binoysankar did you manage to come up with a work around? Experiencing the same problem...

[yawkat]

you can implement this with a custom key store loader, kind of like this:

@Singleton
@Requires(classes = ServerSslBuilder.class)
@Requires(missingBeans = SelfSignedSslBuilder.class)
@Replaces(CertificateProvidedSslBuilder.class)
final class ServerSslBuilderImpl extends CertificateProvidedSslBuilder {
    private final CertLoader certLoader;

    public ServerSslBuilderImpl(ServerSslConfiguration ssl, HttpServerConfiguration httpServerConfiguration, ResourceResolver resourceResolver, CertLoader certLoader) {
        super(httpServerConfiguration, ssl, resourceResolver);
        this.certLoader = certLoader;
    }

    @Override
    protected Optional<KeyStore> getKeyStore(SslConfiguration ssl) throws Exception {
        String path = ssl.getKeyStore().getPath().orElse(null);
        if (path == null || !path.startsWith("base64:")) {
            return super.getKeyStore(ssl);
        } else {
            return Optional.of(...);
        }
    }
}

[VishGov]

@yawkat can this be implemented like how it is done by spring boot out of the box? :
spring-projects/spring-boot#36033

[yawkat]

Yes. I think the above code sample I gave would be appropriate, with a base64: prefix accepted in the path.

[VishGov]

@yawkat thanks for this. However I wanted to configure SSL for Micronaut Kafka Listener.

We are using the @KafkaListener annotation with 'groupId','offsetStrategy', 'offsetReset','errorStrategy', 'properties' being configured via the annotation. I am trying to understand how we can programmatically configure this KafkaListener with the base64encoded strings for keystore and truststore somehow as the above snippet (after some modifications to load the keystore/truststore), did not work for me