Refactor CertUtils. Support ECDSA and PrivateKey.#529
Refactor CertUtils. Support ECDSA and PrivateKey.#529marcuslinke merged 1 commit intodocker-java:masterfrom
Conversation
Current coverage is
|
|
@marcuslinke could you review? |
|
@KostyaSha LGTM 👍 |
|
@marcuslinke how do you handle certs? I have shell scripts that generates server/client certs, but they should be tied to some hostname/address. I used 192.168.99.100 for my docker-machine but it not ideal. |
|
@KostyaSha Currently I manage IP/certs manually in my local However when working with DIND we need to generate certs that are tied to the current DOCKER_HOST ip, right? This could be done when starting the DIND container I think. After that we could copy them via https://docs.docker.com/engine/reference/api/docker_remote_api_v1.22/#get-an-archive-of-a-filesystem-resource-in-a-container to our local java env. WDYT? |
|
First of all i found that openssl tool may differ, so we should run generation in reproducible env. dind easily runs, but i don't remember about port in cert validability... I could tre reimplement my tests. |
|
And this wouldn't work because netty uses sslcontext now? |
|
Found, it wrapped now.. Maybe let's merge without tests? Too much time left... |
|
@marcuslinke let's merge? This should fix user issues. |
| InvalidKeySpecException, IOException, CertificateException, KeyStoreException { | ||
| KeyPair keyPair = loadPrivateKey(dockerCertPath); | ||
| List<Certificate> privateCertificates = loadCertificates(dockerCertPath); | ||
| return createKeyStore("key.pem", "cert.pem"); |
There was a problem hiding this comment.
dockerCertPath is ignored completely here.
There was a problem hiding this comment.
Smells like i missed this wrapper when refactored methods to be reusable for non-file based usage.
Could you fix or should i?
There was a problem hiding this comment.
i guess it should just load files into string, or pass streams and everything would work
There was a problem hiding this comment.
Tried to load into strings but I ended with a javax.ws.rs.ProcessingException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed
There was a problem hiding this comment.
maybe ca.cert is missing?
There was a problem hiding this comment.
call to createTrustStore...
There was a problem hiding this comment.
Right, had a typo there. Now it seems to work.
This change is