Fix SSL config for JDK PKCS setup

Fix issue opensearch-project#4961 by defaulting the keystore_keypassword setting to the same value as the keystore_password Signed-off-by: Andrey Pleskach <[email protected]>
willyborankin · Dec 30, 2024 · 7b448e5 · 7b448e5
1 parent a3345ef
commit 7b448e5
Showing 1 changed file with 7 additions and 2 deletions.
diff --git a/src/main/java/org/opensearch/security/ssl/config/SslCertificatesLoader.java b/src/main/java/org/opensearch/security/ssl/config/SslCertificatesLoader.java
@@ -62,6 +62,7 @@ public Tuple<TrustStoreConfiguration, KeyStoreConfiguration> loadConfiguration(f
         final var settings = environment.settings();
         final var sslConfigSettings = settings.getByPrefix(fullSslConfigSuffix);
         if (settings.hasValue(sslConfigSuffix + KEYSTORE_FILEPATH)) {
+            final var keyStorePassword = resolvePassword(sslConfigSuffix + KEYSTORE_PASSWORD, settings, DEFAULT_STORE_PASSWORD);
             return Tuple.tuple(
                 environment.settings().hasValue(sslConfigSuffix + TRUSTSTORE_FILEPATH)
                     ? buildJdkTrustStoreConfiguration(
@@ -73,8 +74,12 @@ public Tuple<TrustStoreConfiguration, KeyStoreConfiguration> loadConfiguration(f
                 buildJdkKeyStoreConfiguration(
                     sslConfigSettings,
                     environment,
-                    resolvePassword(sslConfigSuffix + KEYSTORE_PASSWORD, settings, DEFAULT_STORE_PASSWORD),
-                    resolvePassword(fullSslConfigSuffix + KEYSTORE_KEY_PASSWORD, settings, DEFAULT_STORE_PASSWORD)
+                    keyStorePassword,
+                    resolvePassword(
+                        fullSslConfigSuffix + KEYSTORE_KEY_PASSWORD,
+                        settings,
+                        keyStorePassword != null ? String.valueOf(keyStorePassword) : null
+                    )
                 )
             );
         } else {