PropertiesSslBundle Class — spring-boot Architecture

Source Code

core/spring-boot-autoconfigure/src/main/java/org/springframework/boot/autoconfigure/ssl/PropertiesSslBundle.java lines 49–193

public final class PropertiesSslBundle implements SslBundle {

	private final SslStoreBundle stores;

	private final SslBundleKey key;

	private final SslOptions options;

	private final String protocol;

	private final SslManagerBundle managers;

	private PropertiesSslBundle(SslStoreBundle stores, SslBundleProperties properties) {
		this.stores = stores;
		this.key = asSslKeyReference(properties.getKey());
		this.options = asSslOptions(properties.getOptions());
		this.protocol = properties.getProtocol();
		this.managers = SslManagerBundle.from(this.stores, this.key);
	}

	private static SslBundleKey asSslKeyReference(@Nullable Key key) {
		return (key != null) ? SslBundleKey.of(key.getPassword(), key.getAlias()) : SslBundleKey.NONE;
	}

	private static SslOptions asSslOptions(SslBundleProperties.@Nullable Options options) {
		return (options != null) ? SslOptions.of(options.getCiphers(), options.getEnabledProtocols()) : SslOptions.NONE;
	}

	@Override
	public SslStoreBundle getStores() {
		return this.stores;
	}

	@Override
	public SslBundleKey getKey() {
		return this.key;
	}

	@Override
	public SslOptions getOptions() {
		return this.options;
	}

	@Override
	public String getProtocol() {
		return this.protocol;
	}

	@Override
	public SslManagerBundle getManagers() {
		return this.managers;
	}

	/**
	 * Get an {@link SslBundle} for the given {@link PemSslBundleProperties}.
	 * @param properties the source properties
	 * @return an {@link SslBundle} instance
	 */
	public static SslBundle get(PemSslBundleProperties properties) {
		return get(properties, ApplicationResourceLoader.get());
	}

	/**
	 * Get an {@link SslBundle} for the given {@link PemSslBundleProperties}.
	 * @param properties the source properties
	 * @param resourceLoader the resource loader used to load content
	 * @return an {@link SslBundle} instance
	 * @since 3.3.5
	 */
	public static SslBundle get(PemSslBundleProperties properties, ResourceLoader resourceLoader) {
		PemSslStore keyStore = getPemSslStore("keystore", properties.getKeystore(), resourceLoader);
		if (keyStore != null) {
			keyStore = keyStore.withAlias(properties.getKey().getAlias())
				.withPassword(properties.getKey().getPassword());
		}
		PemSslStore trustStore = getPemSslStore("truststore", properties.getTruststore(), resourceLoader);
		SslStoreBundle storeBundle = new PemSslStoreBundle(keyStore, trustStore);
		return new PropertiesSslBundle(storeBundle, properties);
	}

	private static @Nullable PemSslStore getPemSslStore(String propertyName, PemSslBundleProperties.Store properties,
			ResourceLoader resourceLoader) {
		PemSslStoreDetails details = asPemSslStoreDetails(properties);
		PemSslStore pemSslStore = PemSslStore.load(details, resourceLoader);
		if (properties.isVerifyKeys()) {
			Assert.state(pemSslStore != null, "'pemSslStore' must not be null");
			PrivateKey privateKey = pemSslStore.privateKey();
			Assert.state(privateKey != null, "'privateKey' must not be null");
			CertificateMatcher certificateMatcher = new CertificateMatcher(privateKey);
			List<X509Certificate> certificates = pemSslStore.certificates();
			Assert.state(certificates != null, "'certificates' must not be null");
			Assert.state(certificateMatcher.matchesAny(certificates),
					() -> "Private key in %s matches none of the certificates in the chain".formatted(propertyName));
		}
		return pemSslStore;
	}

	private static PemSslStoreDetails asPemSslStoreDetails(PemSslBundleProperties.Store properties) {
		return new PemSslStoreDetails(properties.getType(), properties.getCertificate(), properties.getPrivateKey(),
				properties.getPrivateKeyPassword());
	}

	/**
	 * Get an {@link SslBundle} for the given {@link JksSslBundleProperties}.
	 * @param properties the source properties
	 * @return an {@link SslBundle} instance
	 */
	public static SslBundle get(JksSslBundleProperties properties) {
		return get(properties, ApplicationResourceLoader.get());
	}

	/**
	 * Get an {@link SslBundle} for the given {@link JksSslBundleProperties}.
	 * @param properties the source properties
	 * @param resourceLoader the resource loader used to load content
	 * @return an {@link SslBundle} instance
	 * @since 3.3.5
	 */
	public static SslBundle get(JksSslBundleProperties properties, ResourceLoader resourceLoader) {
		SslStoreBundle storeBundle = asSslStoreBundle(properties, resourceLoader);
		return new PropertiesSslBundle(storeBundle, properties);
	}

	private static SslStoreBundle asSslStoreBundle(JksSslBundleProperties properties, ResourceLoader resourceLoader) {
		JksSslStoreDetails keyStoreDetails = asStoreDetails(properties.getKeystore());
		JksSslStoreDetails trustStoreDetails = asStoreDetails(properties.getTruststore());
		return new JksSslStoreBundle(keyStoreDetails, trustStoreDetails, resourceLoader);
	}

	private static JksSslStoreDetails asStoreDetails(JksSslBundleProperties.Store properties) {
		return new JksSslStoreDetails(properties.getType(), properties.getProvider(), properties.getLocation(),
				properties.getPassword());
	}

	@Override
	public String toString() {
		ToStringCreator creator = new ToStringCreator(this);
		creator.append("key", this.key);
		creator.append("options", this.options);
		creator.append("protocol", this.protocol);
		creator.append("stores", this.stores);
		return creator.toString();
	}

}