Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix AliasX509ExtendedKeyManager to process both server and client aliases properly #44629

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

ecnabogs
Copy link

@ecnabogs ecnabogs commented Mar 6, 2025

SpringBoot provides a default implementation of the org.springframework.boot.ssl.SslManagerBundle interface (DefaultSslManagerBundle) that allows to specify a SslBundleKey (referencing the private key within the associated KeyStore) to be used for establishing an SSL connection. This feature, added in SpringBoot 3.1.0, is really appreciable as it simplifies a lot the selection of the private key to be used during SSL handshake.
However, the thing is that the underlying implementation (AliasX509ExtendedKeyManager) only considers the server-side of an SSL connection. If a client has to communicate with multiple partners through mTLS protocol and has a single KeyStore containing its private keys, it cannot select the appropriate key alias to be used with the related partner.

My proposal is to support this use case and to make AliasX509ExtendedKeyManager working similarly for both server and client sides. That's the first point.

Then, looking more in details at the implementation, I noticed that the selected alias was returned unconditionally at the server side. I think it is not correct as SSL handshake is expected to reach an agreement between client and server, especially regarding the key algorithm to be used. Here, this algorithm is not taken into account meaning that although the key with the specified alias could exist in the underlying KeyStore, it could also be of the wrong type.
Thus, my implementation gets inspired by the JDK default implementation (sun.security.ssl.SunX509KeyManagerImpl) in which the alias selection is made by calling the getServerAliases(keyType, ...) or getClientAliases(keyType, ...) for restricting the choice to compatible keys only.

Finally, the AliasX509ExtendedKeyManager current implementation also only considers the transport-independent SSLEngine but not the Socket-specific one. To cover all use cases, the implementation should also apply the same alias selection logic to the Socket-specific methods. That's what I did actually and factorized this logic for all contexts.

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Mar 6, 2025
@ecnabogs ecnabogs force-pushed the fix_alias_x509_extended_key_manager branch from 6ace75c to 190f7f1 Compare March 6, 2025 16:15
@ecnabogs ecnabogs force-pushed the fix_alias_x509_extended_key_manager branch from 190f7f1 to 1a9d178 Compare March 6, 2025 17:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
status: waiting-for-triage An issue we've not yet triaged
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants