Show certificates from truststore in SSL info endpoint

[garvit-joshi]

Adds trustStoreCertificateChains field to BundleInfo to expose truststore certificates separately from keystore certificates in the SSL info endpoint.

Closes #45845

[mhalbritter]

Hello @garvit-joshi,

thanks for the PR. I played around with it a bit, and while this works when the truststore has "Private Key" entries in it (secret key + certificate), it fails when a truststore only contains "Trusted Certificate" entries.

The reason is that KeyStore.getCertificateChain only works for "Private Key" entries, as stated in the JavaDoc:

Returns the certificate chain associated with the given alias. The certificate chain must have been associated with the alias by a call to setKeyEntry, or by a call to setEntry with a PrivateKeyEntry.

To get the (leaf) certificate for a "Trusted Certificate" entry, you'd need to call KeyStore.getCertificate. Hoewever, this will only give you the leaf certificate (the last one in the chain). So either we rename trustStoreCertificateChains to trustStoreCertificates or we need to go the hard route of getting the complete chain for a truststore "Trusted Certificate" entry.

You can use those two keystores to play around, the passwords for both the keystore and the private keys is secret. The keystore contains "Private Key" entries, while the truststore contains "Trusted Certificate" entries (I haven't put in the work to really create a chain of trust, it's all self-signed certificates without a real chain).

We should also verify that it works with a test which doesn't reuse the keystore as the truststore.

[garvit-joshi]

Hi @mhalbritter,

Thank you for the detailed feedback and for providing the test keystores!

I've updated the implementation to handle trustedCertEntry entries. The code now first tries getCertificateChain() for PrivateKeyEntry entries, and falls back to getCertificate() for trustedCertEntry entries.

I've also added a new test separateKeyStoreAndTrustStoreShouldProvideSslInfo() that uses separate keystore (with 2 PrivateKeyEntry entries) and truststore (with 3 trustedCertEntry entries) to verify both scenarios work correctly.

Thanks again for your guidance!

[garvit-joshi]

Build got failed due to formatting issues. I have formatted the required files.

[garvit-joshi]

Hi @mhalbritter,
I've created a small test project to verify the fix works correctly with the keystores you provided: https://github.com/garvit-joshi/pr-48967

The SSL info endpoint now correctly returns:

• certificateChains: 2 entries from keystore (PrivateKeyEntry)
• trustStoreCertificates: 3 entries from truststore (trustedCertEntry)

[mhalbritter]

Thanks @garvit-joshi !