test: harden generated TLS trust setup

Author: szijpeter

waltid-services/waltid-service-commons-test/src/main/kotlin/id/walt/commons/testing/TestTls.kt

@@ -10,8 +10,8 @@ import java.net.InetAddress
 import java.security.KeyPair
 import java.security.KeyStore
 import java.security.PrivateKey
-import java.security.cert.CertificateException
 import java.security.cert.X509Certificate
+import java.util.UUID
 import javax.net.ssl.SSLContext
 import javax.net.ssl.TrustManagerFactory
 import javax.net.ssl.X509TrustManager
@@ -27,7 +27,7 @@ import javax.security.auth.x500.X500Principal
 object TestTls {
     const val SERVER_ALIAS = "waltid-test-server"
     private const val CA_ALIAS = "waltid-test-ca"
-    private const val PASSWORD = "waltid-test-only"
+    private val keyStorePassword = UUID.randomUUID().toString()
 
     private data class Material(
         val serverKeyStore: KeyStore,
@@ -41,7 +41,7 @@ object TestTls {
 
     fun caCertificateDer(): ByteArray = material.caCertificate.encoded
 
-    fun password(): CharArray = PASSWORD.toCharArray()
+    fun password(): CharArray = keyStorePassword.toCharArray()
 
     @Volatile
     private var installed = false
@@ -52,33 +52,28 @@ object TestTls {
         if (installed) return
 
         val systemTrustManager = defaultTrustManager(null)
-        val testTrustStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply {
+        val combinedTrustStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply {
             load(null, null)
+            systemTrustManager.acceptedIssuers.forEachIndexed { index, certificate ->
+                setCertificateEntry("system-$index", certificate)
+            }
             setCertificateEntry(CA_ALIAS, material.caCertificate)
         }
-        val testTrustManager = defaultTrustManager(testTrustStore)
-        val compositeTrustManager = CompositeTrustManager(systemTrustManager, testTrustManager)
+        val combinedTrustManager = defaultTrustManager(combinedTrustStore)
 
-        SSLContext.getInstance("TLS").apply {
-            init(null, arrayOf(compositeTrustManager), null)
+        SSLContext.getInstance("TLSv1.3").apply {
+            init(null, arrayOf(combinedTrustManager), null)
             SSLContext.setDefault(this)
         }
 
         // CIO obtains its default trust manager from the JSSE trust store rather than SSLContext.
-        // Persist a combined store before any test client engine is initialized.
-        val combinedTrustStore = KeyStore.getInstance(KeyStore.getDefaultType()).apply {
-            load(null, null)
-            systemTrustManager.acceptedIssuers.forEachIndexed { index, certificate ->
-                setCertificateEntry("system-$index", certificate)
-            }
-            setCertificateEntry(CA_ALIAS, material.caCertificate)
-        }
+        // Persist the same combined store before any test client engine is initialized.
         val trustStoreFile = kotlin.io.path.createTempFile("waltid-test-trust-", ".p12").toFile().apply {
             deleteOnExit()
             outputStream().use { combinedTrustStore.store(it, password()) }
         }
         System.setProperty("javax.net.ssl.trustStore", trustStoreFile.absolutePath)
-        System.setProperty("javax.net.ssl.trustStorePassword", PASSWORD)
+        System.setProperty("javax.net.ssl.trustStorePassword", keyStorePassword)
         System.setProperty("javax.net.ssl.trustStoreType", combinedTrustStore.type)
 
         installed = true
@@ -87,7 +82,7 @@ object TestTls {
     private fun generateMaterial(): Material {
         val caKeyStore = buildKeyStore {
             certificate(CA_ALIAS) {
-                password = PASSWORD
+                password = keyStorePassword
                 keyType = KeyType.CA
                 hash = HashAlgorithm.SHA256
                 sign = SignatureAlgorithm.RSA
@@ -103,7 +98,7 @@ object TestTls {
         )
         val serverKeyStore = buildKeyStore {
             certificate(SERVER_ALIAS) {
-                password = PASSWORD
+                password = keyStorePassword
                 keyType = KeyType.Server
                 hash = HashAlgorithm.SHA256
                 sign = SignatureAlgorithm.RSA
@@ -122,37 +117,6 @@ object TestTls {
         TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()).apply {
             init(keyStore)
         }.trustManagers.filterIsInstance<X509TrustManager>().single()
-
-    private class CompositeTrustManager(
-        private val system: X509TrustManager,
-        private val test: X509TrustManager,
-    ) : X509TrustManager {
-        override fun checkClientTrusted(chain: Array<out X509Certificate>, authType: String) =
-            checkTrusted(chain, authType, X509TrustManager::checkClientTrusted)
-
-        override fun checkServerTrusted(chain: Array<out X509Certificate>, authType: String) =
-            checkTrusted(chain, authType, X509TrustManager::checkServerTrusted)
-
-        private fun checkTrusted(
-            chain: Array<out X509Certificate>,
-            authType: String,
-            check: X509TrustManager.(Array<out X509Certificate>, String) -> Unit,
-        ) {
-            try {
-                system.check(chain, authType)
-            } catch (systemFailure: CertificateException) {
-                try {
-                    test.check(chain, authType)
-                } catch (testFailure: CertificateException) {
-                    testFailure.addSuppressed(systemFailure)
-                    throw testFailure
-                }
-            }
-        }
-
-        override fun getAcceptedIssuers(): Array<X509Certificate> =
-            system.acceptedIssuers + test.acceptedIssuers
-    }
 }
 
 /** Adds a server connector backed by [TestTls]'s CA-signed certificate. */