{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/12688","repository_url":"https://api.github.com/repos/spring-projects/spring-boot","labels_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/12688/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/12688/comments","events_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/12688/events","html_url":"https://github.com/spring-projects/spring-boot/issues/12688","id":309937724,"number":12688,"title":"JVM truststore/keystore config conflict with EmbeddedServletContainerCustomizer.setSslStoreProvider(...)","user":{"login":"icha024","id":1731854,"avatar_url":"https://avatars1.githubusercontent.com/u/1731854?v=4","gravatar_id":"","url":"https://api.github.com/users/icha024","html_url":"https://github.com/icha024","followers_url":"https://api.github.com/users/icha024/followers","following_url":"https://api.github.com/users/icha024/following{/other_user}","gists_url":"https://api.github.com/users/icha024/gists{/gist_id}","starred_url":"https://api.github.com/users/icha024/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/icha024/subscriptions","organizations_url":"https://api.github.com/users/icha024/orgs","repos_url":"https://api.github.com/users/icha024/repos","events_url":"https://api.github.com/users/icha024/events{/privacy}","received_events_url":"https://api.github.com/users/icha024/received_events","type":"User","site_admin":false},"labels":[{"id":16916892,"url":"https://api.github.com/repos/spring-projects/spring-boot/labels/status:%20duplicate","name":"status: duplicate","color":"fef2c0","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":5,"created_at":"2018-03-29T23:49:17Z","updated_at":"2018-05-29T22:36:41Z","closed_at":"2018-05-29T22:15:34Z","author_association":"CONTRIBUTOR","body":"### Env\r\nSpring-Boot 1.5.10\r\n(Default Tomcat servlet)\r\n\r\n### Use case\r\nI have to interact with multiple systems that require SSL client, and so the easiest thing to do is to set the truststore with global CA cert on the whole app via `-Djavax.net.ssl.trustStore=...`\r\n\r\nAnd I need to load the private keypair programatically via Vault on startup.\r\n\r\n### Issue\r\nTruststore created by `EmbeddedServletContainerCustomizer.setSslStoreProvider(...)` does not seem to have a default password. This is normally fine, but when used with `-Djavax.net.ssl.trustStorePassword=...` to set a global truststore/password then this error shows in the logs:\r\n```\r\njava.security.UnrecoverableKeyException: Password verification failed\r\n```\r\nIt looks like Tomcat is using the JVM arg to validate the SslStoreProvider truststore even when a customised SSL Provider was passed in.\r\n\r\n### To Replicate\r\nGet Mark Paluch's sample project on Spring Cloud Vault to set SSL store provider programatically on startup:\r\nhttps://github.com/mp911de/spring-cloud-vault-config-samples/blob/master/spring-cloud-vault/pki/readme.md\r\n\r\nRun it with the `-Djavax.net.ssl.trustStorePassword=...` flag\r\n\r\n### What I've tried so far\r\n\r\n1. I've tried `EmbeddedServletContainerCustomizer.setSsl(...)` to pass in a password, it didn't work. I also tried omitting the password - also didn't work.\r\n\r\n2. Read in the truststore file, then merged it with the Vault's response cert chain as the SSL Provider, and then remove the trustore JVM property before Tomcat loads - this seem to have worked, but anything that get loaded after this no longer have access to the global truststore config (not a very nice solution)"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-boot/issues/comments/392970128","html_url":"https://github.com/spring-projects/spring-boot/issues/12688#issuecomment-392970128","issue_url":"https://api.github.com/repos/spring-projects/spring-boot/issues/12688","id":392970128,"user":{"login":"mbhave","id":1761408,"avatar_url":"https://avatars0.githubusercontent.com/u/1761408?v=4","gravatar_id":"","url":"https://api.github.com/users/mbhave","html_url":"https://github.com/mbhave","followers_url":"https://api.github.com/users/mbhave/followers","following_url":"https://api.github.com/users/mbhave/following{/other_user}","gists_url":"https://api.github.com/users/mbhave/gists{/gist_id}","starred_url":"https://api.github.com/users/mbhave/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mbhave/subscriptions","organizations_url":"https://api.github.com/users/mbhave/orgs","repos_url":"https://api.github.com/users/mbhave/repos","events_url":"https://api.github.com/users/mbhave/events{/privacy}","received_events_url":"https://api.github.com/users/mbhave/received_events","type":"User","site_admin":false},"created_at":"2018-05-29T22:36:41Z","updated_at":"2018-05-29T22:36:41Z","author_association":"CONTRIBUTOR","body":"Marking as a duplicate in favor of PR #13088."}}
{"actor":{"display_login":"mbhave"}}