Skip to content

Use generateCertifiactes and BC Provider in TruststoreBuilder.mergePemFile #53706

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
rmartinc wants to merge 1 commit into from
Closed

Use generateCertifiactes and BC Provider in TruststoreBuilder.mergePemFile #53706

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 14 additions & 25 deletions services/src/main/java/org/keycloak/truststore/TruststoreBuilder.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.List;
import java.util.stream.Stream;
Expand Down Expand Up @@ -268,33 +269,21 @@ static KeyStore loadStore(String path, String type, String password) {

static boolean mergePemFile(KeyStore truststore, String file, boolean isPem) {
try (FileInputStream pemInputStream = new FileInputStream(file)) {
CertificateFactory certFactory = CertificateFactory.getInstance("X509");
boolean loadedAny = false;
while (pemInputStream.available() > 0) {
X509Certificate cert;
try {
cert = (X509Certificate) certFactory.generateCertificate(pemInputStream);
loadedAny = true;
} catch (CertificateException e) {
if (pemInputStream.available() > 0 || !loadedAny) {
// any remaining input means there is an actual problem with the key contents or
// file format
if (isPem || loadedAny) {
throw e;
}
LOGGER.debugf(e,
"The file %s may not be in PEM format, it will not be used to create the merged truststore",
new File(file).getAbsolutePath());
continue;
}
LOGGER.debugf(e,
"The trailing entry for %s generated a certificate exception, assuming instead that the file ends with comments",
new File(file).getAbsolutePath());
continue;
}
CertificateFactory certFactory = CertificateFactory.getInstance("X509", CryptoIntegration.getProvider().getBouncyCastleProvider());
Collection<X509Certificate> certs = (Collection<X509Certificate>) certFactory.generateCertificates(pemInputStream);
for (X509Certificate cert : certs) {
setCertificateEntry(truststore, cert);
}
return loadedAny;
return !certs.isEmpty();
} catch (CertificateException e) {
if (isPem) {
throw new RuntimeException(
"Failed to initialize truststore, could not merge: " + new File(file).getAbsolutePath(), e);
}
LOGGER.debugf(e,
"The file %s may not be in PEM format, it will not be used to create the merged truststore",
new File(file).getAbsolutePath());
return false;
} catch (Exception e) {
throw new RuntimeException(
"Failed to initialize truststore, could not merge: " + new File(file).getAbsolutePath(), e);
Expand Down
Loading