InstanceCertManager { private boolean loadCertificateAuthorityBundles() { responseSendSSHSignerCerts = Boolean.parseBoolean( System.getProperty(ZTSConsts.ZTS_PROP_RESP_SSH_SIGNER_CERTS, "true")); responseSendX509SignerCerts = Boolean.parseBoolean( System.getProperty(ZTSConsts.ZTS_PROP_RESP_X509_SIGNER_CERTS, "true")); if (responseSendX509SignerCerts) { caX509CertificateSigner = loadCertificateBundle(ZTSConsts.ZTS_PROP_X509_CA_CERT_FNAME); } if (responseSendSSHSignerCerts) { sshUserCertificateSigner = loadCertificateBundle(ZTSConsts.ZTS_PROP_SSH_USER_CA_CERT_FNAME); sshHostCertificateSigner = loadCertificateBundle(ZTSConsts.ZTS_PROP_SSH_HOST_CA_CERT_FNAME); } certAuthorityBundles = new HashMap<>(); final String caBundleFile = System.getProperty(ZTSConsts.ZTS_PROP_CERT_BUNDLES_FNAME); if (caBundleFile == null || caBundleFile.isEmpty()) { return true; } byte[] data = readFileContents(caBundleFile); if (data == null) { return false; } CertBundles certBundles = null; try { certBundles = jsonMapper.readValue(data, CertBundles.class); } catch (Exception ex) { LOGGER.error("Unable to parse CA bundle file: {} - {}", caBundleFile, ex.getMessage()); } if (certBundles == null) { return false; } List<CertBundle> bundleList = certBundles.getCertBundles(); if (bundleList == null || bundleList.isEmpty()) { LOGGER.error("No CA bundles available in the file: {}", caBundleFile); return false; } for (CertBundle bundle : bundleList) { if (!processCertificateAuthorityBundle(bundle)) { return false; } } return true; } InstanceCertManager(final PrivateKeyStore keyStore, Authorizer authorizer, HostnameResolver hostnameResolver,
            boolean readOnlyMode); void setCertStore(CertRecordStore certStore); void setSSHStore(SSHRecordStore sshStore); CertificateAuthorityBundle getCertificateAuthorityBundle(final String name); List<X509CertRecord> getUnrefreshedCertsNotifications(String serverHostName, String provider); X509CertRecord getX509CertRecord(final String provider, X509Certificate cert); X509CertRecord getX509CertRecord(final String provider, final String instanceId,
            final String service); boolean updateX509CertRecord(X509CertRecord certRecord); boolean deleteX509CertRecord(final String provider, final String instanceId,
            final String service); boolean insertX509CertRecord(X509CertRecord certRecord); String generateX509Certificate(final String csr, final String keyUsage, int expiryTime); String getCACertificate(); InstanceIdentity generateIdentity(String csr, String cn, String keyUsage,
            int expiryTime); String getX509CertificateSigner(); SSHCertificates generateSSHCertificates(Principal principal, SSHCertRequest certRequest); boolean generateSSHIdentity(Principal principal, InstanceIdentity identity, final String hostname,
            final String csr, SSHCertRecord sshCertRecord, final String certType); boolean authorizeLaunch(Principal providerService, String domain, String service,
            StringBuilder errorMsg); boolean verifyCertRefreshIPAddress(final String ipAddress); boolean verifyInstanceCertIPAddress(final String provider, final String ipAddress); boolean validPrincipals(final String hostname, SSHCertRecord sshCertRecord, SshHostCsr sshHostCsr); void logX509Cert(final Principal principal, final String ip, final String provider,
            final String instanceId, final X509Certificate x509Cert); SSHCertRecord getSSHCertRecord(final String instanceId, final String service); boolean updateSSHCertRecord(SSHCertRecord certRecord, boolean refresh); boolean enableCertStoreNotifications(NotificationManager notificationManager, RolesProvider rolesProvider, String serverName); boolean enableSSHStoreNotifications(NotificationManager notificationManager, RolesProvider rolesProvider, String serverName);  }
@Test public void loadCertificateAuthorityBundles() throws IOException { System.setProperty(ZTSConsts.ZTS_PROP_CERT_BUNDLES_FNAME, "src/test/resources/ca-bundle-file.json"); InstanceCertManager certManager = new InstanceCertManager(null, null, null, true); CertificateAuthorityBundle bundleAthenz = certManager.getCertificateAuthorityBundle("athenz"); assertNotNull(bundleAthenz); assertEquals(bundleAthenz.getName(), "athenz"); final String athenzData = bundleAthenz.getCerts(); CertificateAuthorityBundle bundleSystem = certManager.getCertificateAuthorityBundle("system"); assertNotNull(bundleSystem); assertEquals(bundleSystem.getName(), "system"); final String systemData = bundleSystem.getCerts(); assertEquals(athenzData, systemData); File caFile = new File("src/test/resources/x509_certs_no_comments.pem"); byte[] data = Files.readAllBytes(Paths.get(caFile.toURI())); assertEquals(athenzData, new String(data)); CertificateAuthorityBundle bundleSsh = certManager.getCertificateAuthorityBundle("ssh"); assertNotNull(bundleSsh); assertEquals(bundleSsh.getName(), "ssh"); final String sshData = bundleSsh.getCerts(); assertEquals(sshData, "ssh-certificate-authority-keys"); System.clearProperty(ZTSConsts.ZTS_PROP_CERT_BUNDLES_FNAME); }