From 0ca5de03df99d73010126b7ec4894d7349647a08 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Wed, 30 Aug 2017 11:51:35 +0200 Subject: [PATCH] Initialize KeyStoreConfiguration without password. We now initialize KeyStoreConfiguration without a password to prevent unintended keystore integrity. Previously we initialized the password with an empty char array which triggered a password check/integrity verification and caused a false keystore tampering alert. Fixes gh-131. --- .../org/springframework/vault/support/SslConfiguration.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java index 637fb268..9f85fd43 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java @@ -331,7 +331,7 @@ public class SslConfiguration { public static class KeyStoreConfiguration { private static final KeyStoreConfiguration UNCONFIGURED = new KeyStoreConfiguration( - AbsentResource.INSTANCE, new char[0], DEFAULT_KEYSTORE_TYPE); + AbsentResource.INSTANCE, null, DEFAULT_KEYSTORE_TYPE); /** * Store that holds certificates, private keys. @@ -380,7 +380,7 @@ public class SslConfiguration { * @since 2.0 */ public static KeyStoreConfiguration of(Resource resource) { - return new KeyStoreConfiguration(resource, new char[0], DEFAULT_KEYSTORE_TYPE); + return new KeyStoreConfiguration(resource, null, DEFAULT_KEYSTORE_TYPE); } /**