Louis Jacomet <******@****.***> 1711728981 +0100

Louis Jacomet <******@****.***> 1711728981 +0100

        "ssl truststore path"     | DaemonJvmOptions.SSL_TRUSTSTORE_KEY       | "-D${DaemonJvmOptions.SSL_TRUSTSTORE_KEY}=truststore/path"
        "ssl truststore password" | DaemonJvmOptions.SSL_TRUSTPASSWORD_KEY    | "-D${DaemonJvmOptions.SSL_TRUSTPASSWORD_KEY}=secret"

     we need to merge JDK's cacerts into the custom truststore via:

     keytool -importkeystore -srckeystore <JDK cacerts file location> -destkeystore <resource>/test-key-store/trustStore

     Note:
      1. Use JDK8 keytool command to make sure compatibility.
      2. Default password for JDK cacerts is "changeit".

     The current trustStore-adoptopenjdk-8 is created from AdoptOpenJDK8 cacerts.
     */

        sslContextFactory.setKeyStorePath(keyStore)
        sslContextFactory.setKeyStorePassword(keyPassword)
        if (trustStore) {
            sslContextFactory.needClientAuth = true
            sslContextFactory.setTrustStorePath(trustStore)
        }
        if (trustPassword) {
            sslContextFactory.setTrustStorePassword(trustPassword)
        }
        configureServer.execute(sslContextFactory)

set FESS_JAVA_OPTS=%FESS_JAVA_OPTS% -Dlog4j2.formatMsgNoLookups=true
set FESS_JAVA_OPTS=%FESS_JAVA_OPTS% -Dlog4j.skipJansi=true

REM SSL truststore for certificate validation over https
REM FESS_JAVA_OPTS=%FESS_JAVA_OPTS% -Djavax.net.ssl.trustStore=/tech/elastic/config/truststore.jks
REM FESS_JAVA_OPTS=%FESS_JAVA_OPTS% -Djavax.net.ssl.trustStorePassword=changeit

REM Causes the JVM to dump its heap on OutOfMemory.

        cleanup:
        Security.removeProvider(FakeKeyStore.Provider.name)
    }

    def "non-existent truststore file"() {
        given:
        keyStore = TestKeyStore.init(resources.dir)
        setupSystemProperties()
        System.properties["javax.net.ssl.trustStore"] = "will-not-exist"

        when:
        performAuthenticatedRequest(false)

        then:

    insecureHosts: List<String>,
  ): X509TrustManager {
    val trustStore = newEmptyKeyStore(keyStoreType)
    for (i in trustedCertificates.indices) {
      trustStore.setCertificateEntry("cert_$i", trustedCertificates[i])
    }

    val factory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
    factory.init(trustStore)
    val result = factory.trustManagers!!

fi

# External opensearch cluster
#SEARCH_ENGINE_HTTP_URL=http://localhost:9200
#FESS_DICTIONARY_PATH=/var/lib/opensearch/config/

# SSL truststore for certificate validation over https
#FESS_JAVA_OPTS="$FESS_JAVA_OPTS -Djavax.net.ssl.trustStore=/tech/elastic/config/truststore.jks"
#FESS_JAVA_OPTS="$FESS_JAVA_OPTS -Djavax.net.ssl.trustStorePassword=changeit"

# min and max heap sizes should be set to the same value to avoid

/**
 * This class contains SSLContext initialization similar to what SSLContext.getDefault() does.
 * Unfortunately, SSLContext.getDefault() can not be used because it is heavily cached by the JVM,
 * including keyStore and trustStore managers.
 * There is no way to reset these caches because they are private and are initialized in static sections.
 */
@NonNullApi
public class SystemDefaultSSLContextFactory {