Web server fails to start due to "Resource location must not be null" when attempting to use a PKCS 11 KeyStore by cdanger · Pull Request #32179 · spring-projects/spring-boot

cdanger · 2022-08-27T17:23:05Z

This fixes the error Unable to start reactive web server / WebServerException: Could not load key store 'null' / IllegalArgumentException: Resource location must not be null (see spring-boot-error.log for the details) when using PKCS11 keystore type (server.ssl.key-store-type property) with undefined/null server.ssl.key-store property (as there is no keystore file in the case of a PKCS#11 HSM) on a Spring Boot Reactor Netty configuration; e.g. running with arguments: --server.ssl.enabled=true --server.ssl.key-store-provider=SunPKCS11-SoftHSM --server.ssl.key-store-type=PKCS11...

This also adds:

Unit tests in spring-boot-project/spring-boot SslServerCustomizerTests class, using a mock PKCS#11 keystore provider implementation, for basic validation of the fix.
TestContainers integration test (requires Docker) in new sub-module spring-boot-tests/spring-boot-smoke-tests/spring-boot-smoke-test-webflux-ssl for more extensive validation: loading a Spring Boot Webflux (Netty SSL server) app with an actual PKCS#11 library (SoftHSM) for the keystore, in order to make sure it works with a full PKCS#11 implementation.

…xception: Could not load key store 'null'" / "IllegalArgumentException: Resource location must not be null" when using PKCS11 keystore type ('server.ssl.key-store-type') with undefined/null 'server.ssl.key-store' property (as there is no keystore file to be specified for a PKCS#11 HSM) on a Spring Boot Reactor Netty configuration. - Added unit tests in spring-boot-project/spring-boot SslServerCustomizerTests class with a mock PKCS#11 keystore provider implementation to validate the fix - Added TestContainers integration test loading a Spring Boot Webflux (Netty SSL server) app with an actual PKCS#11 HSM (SoftHSM) for the keystore: to make sure it works with real implementation: see project spring-boot-tests/spring-boot-smoke-tests/spring-boot-test-webflux-ssl

pivotal-cla · 2022-08-27T17:23:08Z

@cdanger Please sign the Contributor License Agreement!

Click here to manually synchronize the status of this Pull Request.

See the FAQ for frequently asked questions.

pivotal-cla · 2022-08-27T17:47:27Z

@cdanger Thank you for signing the Contributor License Agreement!

wilkinsona · 2022-09-01T20:06:49Z

Thanks very much for the PR, @cdanger.

wilkinsona · 2022-09-01T20:07:39Z

The problem isn't limited to Netty. For example, Tomcat fails in a similar manner:

org.springframework.context.ApplicationContextException: Unable to start web server; nested exception is org.springframework.boot.web.server.WebServerException: Could not load key store 'null'
	at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:163) ~[main/:na]
	at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:577) ~[spring-context-5.3.22.jar:5.3.22]
	at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.refresh(ServletWebServerApplicationContext.java:145) ~[main/:na]
	at org.springframework.boot.SpringApplication.refresh(SpringApplication.java:745) [main/:na]
	at org.springframework.boot.SpringApplication.refreshContext(SpringApplication.java:420) [main/:na]
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:307) [main/:na]
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:1317) [main/:na]
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:1306) [main/:na]
	at smoketest.tomcat.ssl.SampleTomcatSslApplication.main(SampleTomcatSslApplication.java:26) [main/:na]
Caused by: org.springframework.boot.web.server.WebServerException: Could not load key store 'null'
	at org.springframework.boot.web.embedded.tomcat.SslConnectorCustomizer.configureSslKeyStore(SslConnectorCustomizer.java:132) ~[main/:na]
	at org.springframework.boot.web.embedded.tomcat.SslConnectorCustomizer.configureSsl(SslConnectorCustomizer.java:92) ~[main/:na]
	at org.springframework.boot.web.embedded.tomcat.SslConnectorCustomizer.customize(SslConnectorCustomizer.java:57) ~[main/:na]
	at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.customizeSsl(TomcatServletWebServerFactory.java:364) ~[main/:na]
	at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.customizeConnector(TomcatServletWebServerFactory.java:342) ~[main/:na]
	at org.springframework.boot.web.embedded.tomcat.TomcatServletWebServerFactory.getWebServer(TomcatServletWebServerFactory.java:203) ~[main/:na]
	at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.createWebServer(ServletWebServerApplicationContext.java:182) ~[main/:na]
	at org.springframework.boot.web.servlet.context.ServletWebServerApplicationContext.onRefresh(ServletWebServerApplicationContext.java:160) ~[main/:na]
	... 8 common frames omitted
Caused by: java.lang.IllegalArgumentException: Resource location must not be null
	at org.springframework.util.Assert.notNull(Assert.java:201) ~[spring-core-5.3.22.jar:5.3.22]
	at org.springframework.util.ResourceUtils.getURL(ResourceUtils.java:130) ~[spring-core-5.3.22.jar:5.3.22]
	at org.springframework.boot.web.embedded.tomcat.SslConnectorCustomizer.configureSslKeyStore(SslConnectorCustomizer.java:129) ~[main/:na]
	... 15 common frames omitted

As part of merging this, we should also make similar changes for Jetty, Tomcat, and Undertow.

…for Netty previously. This is part of PR spring-projects#32179.

…izer classes

cdanger · 2022-09-11T01:06:35Z

As part of merging this, we should also make similar changes for Jetty, Tomcat, and Undertow.

OK I made similar changes for Jetty, Tomcat and Undertow in new commits.
Is it now OK for approval?

cdanger · 2022-10-02T13:44:16Z

Could any maintainer approve this? or tell me whether anything else is needed. Thanks.

wilkinsona · 2022-10-02T19:32:34Z

Thanks for your patience, @cdanger. We'll approve and merge the changes as soon as we can.

mhalbritter · 2022-12-01T12:35:15Z

Thank you!

See gh-32179

Remove `spring-boot-smoke-test-webflux-ssl` since it's more of an integration test than a smoke test. We could consider relocating it to `spring-boot-integration-tests` but since we have unit tests with a mock PCKCS11 security it's probably best to see if we can get away without it. See gh-32179

…ot-starter-parent from 2.3.5.RELEASE to 2.7.7 (minor) This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [org.springframework.boot:spring-boot-starter-parent](https://spring.io/projects/spring-boot) ([source](https://github.com/spring-projects/spring-boot)) | parent | minor | `2.3.5.RELEASE` -> `2.7.7` | --- ### Release Notes <details> <summary>spring-projects/spring-boot</summary> ### [`v2.7.7`](https://github.com/spring-projects/spring-boot/releases/tag/v2.7.7) [Compare Source](spring-projects/spring-boot@v2.7.6...v2.7.7) #### 🐞 Bug Fixes - Fix typo in LocalDevToolsAutoConfiguration logging [#33569](spring-projects/spring-boot#33569) - Web server fails to start due to "Resource location must not be null" when attempting to use a PKCS 11 KeyStore [#32179](spring-projects/spring-boot#32179) #### 📔 Documentation - Improve gradle plugin tags documentation [#33614](spring-projects/spring-boot#33614) - Improve maven plugin tags documentation [#33609](spring-projects/spring-boot#33609) - Fix typo in tomcat accesslog checkExists doc [#33460](spring-projects/spring-boot#33460) - Document that the shutdown endpoint is not intended for use when deploying a war to a servlet container [#17398](spring-projects/spring-boot#17398) #### 🔨 Dependency Upgrades - Upgrade to Byte Buddy 1.12.20 [#33570](spring-projects/spring-boot#33570) - Upgrade to Dropwizard Metrics 4.2.14 [#33571](spring-projects/spring-boot#33571) - Upgrade to Elasticsearch 7.17.8 [#33572](spring-projects/spring-boot#33572) - Upgrade to HttpClient 4.5.14 [#33573](spring-projects/spring-boot#33573) - Upgrade to HttpCore 4.4.16 [#33574](spring-projects/spring-boot#33574) - Upgrade to Infinispan 13.0.14.Final [#33575](spring-projects/spring-boot#33575) - Upgrade to Jaybird 4.0.8.java8 [#33576](spring-projects/spring-boot#33576) - Upgrade to Jetty 9.4.50.v20221201 [#33577](spring-projects/spring-boot#33577) - Upgrade to MSSQL JDBC 10.2.2.jre8 [#33578](spring-projects/spring-boot#33578) - Upgrade to Neo4j Java Driver 4.4.11 [#33579](spring-projects/spring-boot#33579) - Upgrade to Netty 4.1.86.Final [#33580](spring-projects/spring-boot#33580) - Upgrade to Reactor 2020.0.26 [#33543](spring-projects/spring-boot#33543) - Upgrade to Spring Integration 5.5.16 [#33581](https://github.com/spring-projects/spring...

cdanger and others added 2 commits August 27, 2022 19:02

Merge branch 'spring-projects:main' into main

29ef276

spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Aug 27, 2022

cdanger marked this pull request as ready for review August 27, 2022 17:48

wilkinsona changed the title ~~Fixes PKCS#11 support in Spring Boot Reactor Netty SSL server~~ Web server fails to start due to "Resource location must not be null" when attempting to use a PKCS 11 KeyStore Sep 1, 2022

wilkinsona added type: bug A general bug and removed status: waiting-for-triage An issue we've not yet triaged labels Sep 1, 2022

wilkinsona added this to the 2.6.x milestone Sep 1, 2022

wilkinsona added the for: merge-with-amendments Needs some changes when we merge label Sep 1, 2022

cdanger and others added 3 commits September 10, 2022 23:17

Merge branch 'spring-projects:main' into main

df0bcbb

- Fixes PKCS#11 support for Jetty, Tomcat and Undertown, as was done …

905eeed

…for Netty previously. This is part of PR spring-projects#32179.

- Reformatted Tomcat SslConnectorCustomizer and Jetty SslServerCustom…

0eeedf9

…izer classes

wilkinsona modified the milestones: 2.6.x, 2.7.x Nov 24, 2022

mhalbritter removed the for: merge-with-amendments Needs some changes when we merge label Dec 1, 2022

mhalbritter self-assigned this Dec 1, 2022

mhalbritter mentioned this pull request Dec 1, 2022

Web server fails to start due to "Resource location must not be null" when attempting to use a PKCS 11 KeyStore #33433

Closed

mhalbritter modified the milestones: 2.7.x, 2.7.7 Dec 1, 2022

mhalbritter pushed a commit that referenced this pull request Dec 1, 2022

Fix bug in webserver start when loading PKCS#11 KeyStore

716a839

See gh-32179

mhalbritter added a commit that referenced this pull request Dec 1, 2022

Polish "Fix bug in webserver start when loading PKCS#11 KeyStore"

1656909

See gh-32179

mhalbritter closed this in ad2b130 Dec 1, 2022

Netyyyy mentioned this pull request Dec 23, 2022

External dependencies upgrade - Spring Boot 2.7.7 and Spring Cloud 2021.0.5 Azure/azure-sdk-for-java#32697

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Web server fails to start due to "Resource location must not be null" when attempting to use a PKCS 11 KeyStore#32179

Web server fails to start due to "Resource location must not be null" when attempting to use a PKCS 11 KeyStore#32179
cdanger wants to merge 5 commits into
spring-projects:mainfrom
ThalesGroup:main

cdanger commented Aug 27, 2022 •

edited

Loading

Uh oh!

pivotal-cla commented Aug 27, 2022

Uh oh!

pivotal-cla commented Aug 27, 2022

Uh oh!

wilkinsona commented Sep 1, 2022

Uh oh!

wilkinsona commented Sep 1, 2022

Uh oh!

cdanger commented Sep 11, 2022 •

edited

Loading

Uh oh!

cdanger commented Oct 2, 2022

Uh oh!

wilkinsona commented Oct 2, 2022

Uh oh!

mhalbritter commented Dec 1, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

cdanger commented Aug 27, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

pivotal-cla commented Aug 27, 2022

Uh oh!

pivotal-cla commented Aug 27, 2022

Uh oh!

wilkinsona commented Sep 1, 2022

Uh oh!

wilkinsona commented Sep 1, 2022

Uh oh!

cdanger commented Sep 11, 2022 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cdanger commented Oct 2, 2022

Uh oh!

wilkinsona commented Oct 2, 2022

Uh oh!

mhalbritter commented Dec 1, 2022

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

cdanger commented Aug 27, 2022 •

edited

Loading

cdanger commented Sep 11, 2022 •

edited

Loading