From 877c4f702e85a6eb086dd7f1048208c3609bbc4c Mon Sep 17 00:00:00 2001 From: Madhura Bhave Date: Mon, 23 Apr 2018 12:17:51 -0700 Subject: [PATCH] Use empty key-store-password if storeprovider present For tomcat, if an SslStoreProvider is configured, `SslStoreProviderUrlStreamHandlerFactory` stores the keyStore with an empty password. Previously, if a password was supplied using the ssl.key-store-password property, that would be the password used to load the keystore and the connector would fail with a "Password verification failed" exception. Fixes gh-11391 --- .../embedded/tomcat/SslConnectorCustomizer.java | 1 + .../tomcat/SslConnectorCustomizerTests.java | 16 ++++++++++++++++ 2 files changed, 17 insertions(+) diff --git a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizer.java b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizer.java index 1a3b4d3789..c090c2366e 100644 --- a/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizer.java +++ b/spring-boot-project/spring-boot/src/main/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizer.java @@ -113,6 +113,7 @@ class SslConnectorCustomizer implements TomcatConnectorCustomizer { new SslStoreProviderUrlStreamHandlerFactory(sslStoreProvider)); try { if (sslStoreProvider.getKeyStore() != null) { + protocol.setKeystorePass(""); protocol.setKeystoreFile(SslStoreProviderUrlStreamHandlerFactory.KEY_STORE_URL); } if (sslStoreProvider.getTrustStore() != null) { diff --git a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizerTests.java b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizerTests.java index 129ef15307..bed4f97859 100644 --- a/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizerTests.java +++ b/spring-boot-project/spring-boot/src/test/java/org/springframework/boot/web/embedded/tomcat/SslConnectorCustomizerTests.java @@ -24,6 +24,7 @@ import java.security.KeyStoreException; import java.security.NoSuchAlgorithmException; import java.security.cert.CertificateException; +import org.apache.catalina.LifecycleState; import org.apache.catalina.connector.Connector; import org.apache.catalina.startup.Tomcat; import org.apache.catalina.webresources.TomcatURLStreamHandlerFactory; @@ -154,6 +155,21 @@ public class SslConnectorCustomizerTests { assertThat(sslHostConfig.getCertificateKeystoreFile()).contains(sslHostConfigWithDefaults.getCertificateKeystoreFile()); } + @Test + public void customizeWhenSslStoreProviderPresentShouldIgnorePasswordFromSsl() throws Exception { + Ssl ssl = new Ssl(); + ssl.setKeyPassword("password"); + ssl.setKeyStorePassword("secret"); + SslStoreProvider sslStoreProvider = mock(SslStoreProvider.class); + given(sslStoreProvider.getTrustStore()).willReturn(loadStore()); + given(sslStoreProvider.getKeyStore()).willReturn(loadStore()); + SslConnectorCustomizer customizer = new SslConnectorCustomizer(ssl, sslStoreProvider); + Connector connector = this.tomcat.getConnector(); + customizer.customize(connector); + this.tomcat.start(); + assertThat(connector.getState()).isEqualTo(LifecycleState.STARTED); + } + private KeyStore loadStore() throws KeyStoreException, IOException, NoSuchAlgorithmException, CertificateException { KeyStore keyStore = KeyStore.getInstance("JKS");