Accept PEM-encoded certificates in SslConfiguration.

We now accept PEM-encoded certificates when configuring SSL settings.

KeyStoreConfiguration keystore = KeyStoreConfiguration
        .of(new ClassPathResource("ca.pem")).withStoreType("PEM");
SslConfiguration configuration = SslConfiguration.forTrustStore(keystore);

Closes gh-514.

src/main/asciidoc/new-features.adoc

@@ -1,6 +1,11 @@
 [[new-features]]
 == New & Noteworthy
 
+[[new-features.2-3-0]]
+=== What's new in Spring Vault 2.3
+
+* Support for PEM-encoded certificates for keystore and truststore usage.
+
 [[new-features.2-2-0]]
 === What's new in Spring Vault 2.2
 
@@ -9,7 +14,8 @@
 * Add support for Jetty as reactive HttpClient.
 * `LifecycleAwareSessionManager` and `ReactiveLifecycleAwareSessionManager` emit now ``AuthenticationEvent``s.
 * <<vault.authentication.pcf>>.
-* Deprecation of `AppIdAuthentication`. Use `AppRoleAuthentication` instead as recommended by HashiCorp Vault.
+* Deprecation of `AppIdAuthentication`.
+Use `AppRoleAuthentication` instead as recommended by HashiCorp Vault.
 * `CubbyholeAuthentication` and wrapped `AppRoleAuthentication` now use `sys/wrapping/unwrap` endpoints by default.
 * Kotlin Coroutines support for `ReactiveVaultOperations`.
 

src/main/asciidoc/reference/client-support.adoc

@@ -127,6 +127,18 @@ SslConfiguration.forKeyStore(new FileSystemResource("keystore.jks"),    <4>
 <4> Configuring only key store settings with providing a key-configuration.
 ====
 
-Please note that providing `SslConfiguration` can be only
-applied when either Apache Http Components or the OkHttp client
-is on your class-path.
+Please note that providing `SslConfiguration` can be only applied when either Apache Http Components or the OkHttp client is on your class-path.
+
+The SSL configuration supports also PEM-encoded certificates as alternative to a Java Key Store.
+
+====
+[source,java]
+----
+KeyStoreConfiguration keystore = KeyStoreConfiguration
+        .of(new ClassPathResource("ca.pem")).withStoreType("PEM");
+SslConfiguration configuration = SslConfiguration.forTrustStore(keystore);
+----
+====
+
+PEM files may contain one or more certificates (blocks of `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----`).
+Certificates added to the underlying `KeyStore` use the full subject name as alias.

src/main/asciidoc/reference/imperative-template.adoc

@@ -172,8 +172,10 @@ vault.token=00000000-0000-0000-0000-000000000000
 * SSL Configuration
 ** Keystore resource: `vault.ssl.key-store` (optional)
 ** Keystore password: `vault.ssl.key-store-password` (optional)
+** Keystore type: `vault.ssl.key-store-type` (optional, typically `jks`, supports also `pem`)
 ** Truststore resource: `vault.ssl.trust-store` (optional)
 ** Truststore password: `vault.ssl.trust-store-password` (optional)
+** Truststore type: `vault.ssl.trust-store-type` (optional, typically `jks`, supports also `pem`)
 * Authentication method: `vault.authentication` (defaults to `TOKEN`, supported authentication methods are: `TOKEN`, `APPID`, `APPROLE`, `AWS_EC2`, `AZURE`, `CERT`, `CUBBYHOLE`, `KUBERNETES`)
 
 **Authentication-specific property keys**

src/test/bash/create_certificates.sh

@@ -62,6 +62,10 @@ openssl rsa -in ${CA_DIR}/private/localhost.key.pem \
       -out ${CA_DIR}/private/localhost.decrypted.key.pem \
       -passin pass:changeit
 
+openssl rsa -in ${CA_DIR}/private/localhost.key.pem \
+      -pubout -out ${CA_DIR}/private/localhost.public.key.pem \
+      -passin pass:changeit
+
 chmod 400 ${CA_DIR}/private/localhost.key.pem
 chmod 400 ${CA_DIR}/private/localhost.decrypted.key.pem
 
@@ -82,7 +86,6 @@ openssl ca -config ${DIR}/openssl.cnf \
       -in ${CA_DIR}/csr/localhost.csr.pem \
       -out ${CA_DIR}/certs/localhost.cert.pem
 
-
 echo "[INFO] Generating client auth private key"
 openssl genrsa -aes256 \
       -passout pass:changeit \