From 59bacc6b73a58dc0c29702fc5a13cecf362a0bc1 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Thu, 24 Sep 2020 11:07:56 +0200 Subject: [PATCH] Allow for configurable keystore / truststore type in ssl options MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit We've introduced two new configuration properties (spring.cloud.vault.ssl.key-store-type=…/spring.cloud.vault.ssl.trust-store-type=…) to configure the keystore type including PEM support. Resolves gh-387. --- docs/src/main/asciidoc/authentication.adoc | 1 + docs/src/main/asciidoc/new-features.adoc | 1 + docs/src/main/asciidoc/other-topics.adoc | 2 + .../vault/config/VaultConfiguration.java | 8 +++ .../cloud/vault/config/VaultProperties.java | 62 ++++++++++++++----- 5 files changed, 58 insertions(+), 16 deletions(-) diff --git a/docs/src/main/asciidoc/authentication.adoc b/docs/src/main/asciidoc/authentication.adoc index 05cc9ee0..b4c910d9 100644 --- a/docs/src/main/asciidoc/authentication.adoc +++ b/docs/src/main/asciidoc/authentication.adoc @@ -411,6 +411,7 @@ spring.cloud.vault: ssl: key-store: classpath:keystore.jks key-store-password: changeit + key-store-type: JKS cert-auth-path: cert ---- ==== diff --git a/docs/src/main/asciidoc/new-features.adoc b/docs/src/main/asciidoc/new-features.adoc index a52dc1d6..11792083 100644 --- a/docs/src/main/asciidoc/new-features.adoc +++ b/docs/src/main/asciidoc/new-features.adoc @@ -7,3 +7,4 @@ This section briefly covers items that are new and noteworthy in the latest rele * Migration of `PropertySource` initialization from Spring Cloud's Bootstrap Context to Spring Boot's <>. * Support for the <> backend. +* Configuration of keystore/truststore types through `spring.cloud.vault.ssl.key-store-type=…`/`spring.cloud.vault.ssl.trust-store-type=…` including PEM support. diff --git a/docs/src/main/asciidoc/other-topics.adoc b/docs/src/main/asciidoc/other-topics.adoc index 4669f859..ec1a02b0 100644 --- a/docs/src/main/asciidoc/other-topics.adoc +++ b/docs/src/main/asciidoc/other-topics.adoc @@ -70,12 +70,14 @@ spring.cloud.vault: ssl: trust-store: classpath:keystore.jks trust-store-password: changeit + trust-store-type: JKS ---- ==== * `trust-store` sets the resource for the trust-store. SSL-secured Vault communication will validate the Vault SSL certificate with the specified trust-store. * `trust-store-password` sets the trust-store password +* `trust-store-type` sets the trust-store type. Supported values are all supported `KeyStore` types including `PEM`. Please note that configuring `spring.cloud.vault.ssl.*` can be only applied when either Apache Http Components or the OkHttp client is on your class-path. diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java index 700c9169..7c04eae0 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultConfiguration.java @@ -81,6 +81,10 @@ final class VaultConfiguration { else { keyStore = KeyStoreConfiguration.of(ssl.getKeyStore()); } + + if (StringUtils.hasText(ssl.getKeyStoreType())) { + keyStore = keyStore.withStoreType(ssl.getKeyStoreType()); + } } if (ssl.getTrustStore() != null) { @@ -91,6 +95,10 @@ final class VaultConfiguration { else { trustStore = KeyStoreConfiguration.of(ssl.getTrustStore()); } + + if (StringUtils.hasText(ssl.getTrustStoreType())) { + trustStore = trustStore.withStoreType(ssl.getTrustStoreType()); + } } return new SslConfiguration(keyStore, trustStore); diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java index 68193b96..059dad4e 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java @@ -971,6 +971,13 @@ public class VaultProperties implements EnvironmentAware { */ private String keyStorePassword; + /** + * Type of the key store. + * + * @since 3.0 + */ + private String keyStoreType; + /** * Trust store that holds SSL certificates. */ @@ -981,6 +988,13 @@ public class VaultProperties implements EnvironmentAware { */ private String trustStorePassword; + /** + * Type of the trust store. + * + * @since 3.0 + */ + private String trustStoreType; + /** * Mount path of the TLS cert authentication backend. */ @@ -991,38 +1005,54 @@ public class VaultProperties implements EnvironmentAware { return this.keyStore; } - public String getKeyStorePassword() { - return this.keyStorePassword; - } - - public Resource getTrustStore() { - return this.trustStore; - } - - public String getTrustStorePassword() { - return this.trustStorePassword; - } - - public String getCertAuthPath() { - return this.certAuthPath; - } - public void setKeyStore(Resource keyStore) { this.keyStore = keyStore; } + public String getKeyStorePassword() { + return this.keyStorePassword; + } + public void setKeyStorePassword(String keyStorePassword) { this.keyStorePassword = keyStorePassword; } + public String getKeyStoreType() { + return this.keyStoreType; + } + + public void setKeyStoreType(String keyStoreType) { + this.keyStoreType = keyStoreType; + } + + public Resource getTrustStore() { + return this.trustStore; + } + public void setTrustStore(Resource trustStore) { this.trustStore = trustStore; } + public String getTrustStorePassword() { + return this.trustStorePassword; + } + public void setTrustStorePassword(String trustStorePassword) { this.trustStorePassword = trustStorePassword; } + public String getTrustStoreType() { + return this.trustStoreType; + } + + public void setTrustStoreType(String trustStoreType) { + this.trustStoreType = trustStoreType; + } + + public String getCertAuthPath() { + return this.certAuthPath; + } + public void setCertAuthPath(String certAuthPath) { this.certAuthPath = certAuthPath; }