Skip to content

Support for pkcs1#12670

Merged
normanmaurer merged 6 commits intonetty:4.1from
cwperks:support-for-pkcs1
Aug 10, 2022
Merged

Support for pkcs1#12670
normanmaurer merged 6 commits intonetty:4.1from
cwperks:support-for-pkcs1

Conversation

@cwperks
Copy link
Copy Markdown
Contributor

@cwperks cwperks commented Aug 5, 2022

Signed-off-by: Craig Perkins cwperx@amazon.com

Motivation:

Motivated by a stale PR that was closed. This change adds support for keys in the PKCS#1 format. Currently netty only supports PKCS#8 keys.

Modification:

This change introduces a class called BouncyCastlePemReader which is only used if BouncyCastle is available on the classpath and uses BouncyCastle's PEMParser to parse the private keys. See list of supported types here.

Tests are added in SSLContextTest including tests with PKCS#8 keys (encrypted + unencrypted) to show these working with BouncyCastle.

Result:

Fixes #7323

cwperks added 3 commits August 5, 2022 12:47
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
Copy link
Copy Markdown

@peternied peternied left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I agree with the comments about readability, but its a major improvement so other libraries/products don't have to do this themselves.

cwperks added 2 commits August 8, 2022 09:30
…f clause

Signed-off-by: Craig Perkins <cwperx@amazon.com>
Signed-off-by: Craig Perkins <cwperx@amazon.com>
@cwperks
Copy link
Copy Markdown
Contributor Author

cwperks commented Aug 8, 2022

@normanmaurer Thank you for the review. I have addressed the code review comments and moved this block:

if (!isAvailable()) {
    if (logger.isDebugEnabled()) {
        logger.debug("Bouncy castle provider is unavailable.", unavailabilityCause());
    }
    return null;
}

into the public static PrivateKey BouncyCastlePemReader.getPrivateKey(...) methods and exit early if BC is unavailable.

Signed-off-by: Craig Perkins <cwperx@amazon.com>
@normanmaurer normanmaurer merged commit 91f8ecc into netty:4.1 Aug 10, 2022
@normanmaurer
Copy link
Copy Markdown
Member

@cwperks thanks a lot!

normanmaurer pushed a commit that referenced this pull request Aug 10, 2022
Motivation:

Motivated by a stale [PR](#7451) that was closed. This change adds support for keys in the PKCS#1 format. Currently netty only supports PKCS#8 keys.

Modification:

This change introduces a class called `BouncyCastlePemReader` which is only used if BouncyCastle is available on the classpath and uses BouncyCastle's PEMParser to parse the private keys. See list of supported types [here](https://www.bouncycastle.org/docs/pkixdocs1.5on/org/bouncycastle/openssl/PEMParser.html).

Tests are added in `SSLContextTest` including tests with PKCS#8 keys (encrypted + unencrypted) to show these working with BouncyCastle.

Result:

Fixes [#7323](#7323)

Signed-off-by: Craig Perkins <cwperx@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Feature request: Support PKCS#1 keys when dealing with certificates

3 participants