ZTSUtils { public static SSLContext createServerClientSSLContext(PrivateKeyStore privateKeyStore) { final String keyStorePath = System.getProperty(ATHENZ_PROP_KEYSTORE_PATH); if (keyStorePath == null) { LOGGER.error("Unable to create client ssl context: no keystore path specified"); return null; } final String keyStorePasswordAppName = System.getProperty(ATHENZ_PROP_KEYSTORE_PASSWORD_APPNAME); final String keyStorePassword = System.getProperty(ATHENZ_PROP_KEYSTORE_PASSWORD); final String keyStoreType = System.getProperty(ATHENZ_PROP_KEYSTORE_TYPE, "PKCS12"); final String trustStorePath = System.getProperty(ATHENZ_PROP_TRUSTSTORE_PATH); if (trustStorePath == null) { LOGGER.error("Unable to create client ssl context: no truststore path specified"); return null; } final String trustStorePassword = System.getProperty(ATHENZ_PROP_TRUSTSTORE_PASSWORD); final String trustStorePasswordAppName = System.getProperty(ATHENZ_PROP_TRUSTSTORE_PASSWORD_APPNAME); final String trustStoreType = System.getProperty(ATHENZ_PROP_TRUSTSTORE_TYPE, "PKCS12"); SSLContext sslcontext = null; try { TrustManagerFactory tmfactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); try (FileInputStream instream = new FileInputStream(new File(trustStorePath))) { KeyStore trustStore = KeyStore.getInstance(trustStoreType); final String password = getApplicationSecret(privateKeyStore, trustStorePasswordAppName, trustStorePassword); trustStore.load(instream, getPasswordChars(password)); tmfactory.init(trustStore); } KeyManagerFactory kmfactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm()); try (FileInputStream instream = new FileInputStream(new File(keyStorePath))) { KeyStore keyStore = KeyStore.getInstance(keyStoreType); final String password = getApplicationSecret(privateKeyStore, keyStorePasswordAppName, keyStorePassword); keyStore.load(instream, getPasswordChars(password)); kmfactory.init(keyStore, getPasswordChars(password)); } KeyManager[] keymanagers = kmfactory.getKeyManagers(); TrustManager[] trustmanagers = tmfactory.getTrustManagers(); sslcontext = SSLContext.getInstance("TLSv1.2"); sslcontext.init(keymanagers, trustmanagers, new SecureRandom()); } catch (Exception ex) { LOGGER.error("Unable to create server client ssl context", ex); } return sslcontext; }  static SslContextFactory createSSLContextObject(String[] clientProtocols); static SslContextFactory createSSLContextObject(final String[] clientProtocols,
            final PrivateKeyStore privateKeyStore); static boolean emitMonmetricError(int errorCode, String caller,
            String requestDomain, String principalDomain, Metric metric); static boolean verifyCertificateRequest(PKCS10CertificationRequest certReq,
            final String domain, final String service, X509CertRecord certRecord); static boolean validateCertReqCommonName(PKCS10CertificationRequest certReq, String cn); static String extractCertReqInstanceId(PKCS10CertificationRequest certReq); static Identity generateIdentity(InstanceCertManager certManager, final String csr,
            final String cn, final String certUsage, int expiryTime); static SSLContext createServerClientSSLContext(PrivateKeyStore privateKeyStore); static int parseInt(final String value, int defaultValue); static boolean parseBoolean(final String value, boolean defaultValue); static final String ZTS_CERT_DNS_SUFFIX; }
@Test public void testCreateSSLClientContextObject() { String filePath = Resources.getResource("keystore.pkcs12").getFile(); System.setProperty("athenz.ssl_key_store", filePath); System.setProperty("athenz.ssl_key_store_password", "123456"); filePath = Resources.getResource("truststore.jks").getFile(); System.setProperty("athenz.ssl_trust_store", filePath); System.setProperty("athenz.ssl_trust_store_type", "JKS"); System.setProperty("athenz.ssl_trust_store_password", "123456"); SSLContext sslContext = ZTSUtils.createServerClientSSLContext(null); assertNotNull(sslContext); }
@Test public void testCreateSSLClientContextObjectEmptyKeyStore() { System.clearProperty("athenz.ssl_key_store"); SSLContext sslContext = ZTSUtils.createServerClientSSLContext(null); assertNull(sslContext); }
@Test public void testCreateSSLClientContextObjectEmptyTrustStore() { String filePath = Resources.getResource("keystore.pkcs12").getFile(); System.setProperty("athenz.ssl_key_store", filePath); System.setProperty("athenz.ssl_key_store_password", "123456"); System.clearProperty("athenz.ssl_trust_store"); SSLContext sslContext = ZTSUtils.createServerClientSSLContext(null); assertNull(sslContext); }
@Test public void testCreateSSLClientContextObjectInvalidTrustPass() { String filePath = Resources.getResource("keystore.pkcs12").getFile(); System.setProperty("athenz.ssl_key_store", filePath); System.setProperty("athenz.ssl_key_store_password", "123456"); filePath = Resources.getResource("truststore.jks").getFile(); System.setProperty("athenz.ssl_trust_store", filePath); System.setProperty("athenz.ssl_trust_store_type", "JKS"); System.setProperty("athenz.ssl_trust_store_password", "invalid"); SSLContext sslContext = ZTSUtils.createServerClientSSLContext(null); assertNull(sslContext); }
@Test public void testCreateSSLClientContextObjectNullTrustPass() { String filePath = Resources.getResource("keystore.pkcs12").getFile(); System.setProperty("athenz.ssl_key_store", filePath); System.setProperty("athenz.ssl_key_store_password", "123456"); filePath = Resources.getResource("truststore.jks").getFile(); System.setProperty("athenz.ssl_trust_store", filePath); System.setProperty("athenz.ssl_trust_store_type", "JKS"); System.clearProperty("athenz.ssl_trust_store_password"); SSLContext sslContext = ZTSUtils.createServerClientSSLContext(null); assertNull(sslContext); }
@Test public void testCreateSSLClientContextObjectInvalidKeyPass() { String filePath = Resources.getResource("keystore.pkcs12").getFile(); System.setProperty("athenz.ssl_key_store", filePath); System.setProperty("athenz.ssl_key_store_password", "invalid"); filePath = Resources.getResource("truststore.jks").getFile(); System.setProperty("athenz.ssl_trust_store", filePath); System.setProperty("athenz.ssl_trust_store_type", "JKS"); System.setProperty("athenz.ssl_trust_store_password", "123456"); SSLContext sslContext = ZTSUtils.createServerClientSSLContext(null); assertNull(sslContext); }
@Test public void testCreateSSLClientContextObjectNullKeyPass() { String filePath = Resources.getResource("keystore.pkcs12").getFile(); System.setProperty("athenz.ssl_key_store", filePath); System.clearProperty("athenz.ssl_key_store_password"); filePath = Resources.getResource("truststore.jks").getFile(); System.setProperty("athenz.ssl_trust_store", filePath); System.setProperty("athenz.ssl_trust_store_type", "JKS"); System.setProperty("athenz.ssl_trust_store_password", "123456"); SSLContext sslContext = ZTSUtils.createServerClientSSLContext(null); assertNull(sslContext); }
@Test public void testCreateSSLClientContextObjectInvalidType() { String filePath = Resources.getResource("keystore.pkcs12").getFile(); System.setProperty("athenz.ssl_key_store", filePath); System.setProperty("athenz.ssl_key_store_password", "123456"); filePath = Resources.getResource("truststore.jks").getFile(); System.setProperty("athenz.ssl_trust_store", filePath); System.setProperty("athenz.ssl_trust_store_type", "PKS12"); System.setProperty("athenz.ssl_trust_store_password", "123456"); SSLContext sslContext = ZTSUtils.createServerClientSSLContext(null); assertNull(sslContext); }